Introducing KBOM – Kubernetes Bill of Materials

This document introduces the Kubernetes Bill of Materials (KBOM), a manifest listing the components, versions, and images that compose a Kubernetes cluster (control plane, node components, and addons). It explains how KBOM differs from workload SBOMs, outlines Trivy's initial CycloneDX-based KBOM capability and passive discovery approach, compares it to proactive tools like kube-hunter, and discusses accuracy, testing across distributions, applicability to managed Kubernetes, and planned future enhancements for broader discovery and vulnerability matching.