bug(k8s): KSV110 does not seem to be applied

[simar7]

Discussed in #5083

^{Originally posted by mochizuki875 September 1, 2023}

Question

I'm using trivy config <kubernetes-manifest.yaml> command to find out misconfiguration and some are found.
However, which policy is based for scan?

I've read related section, and found policy repo.

There are some type of policy-set in policy repo and all of them don't seems to applied.
For example, KSV110 in advanced dose not work if I set metadata.namespace: default in Kubernetes manifest.

Target

Kubernetes

Scanner

Misconfiguration

Output Format

Table

Mode

Standalone

Operating System

Linux(5.15.0-78-generic) Ubuntu 22.04

Version

$ trivy --version
Version: 0.42.1
Policy Bundle:
  Digest: sha256:fd5f1ce3d8efb1fe158cb41f9adb9d7c7cc5c4c863b261053c962e6d950350b3
  DownloadedAt: 2023-09-01 06:29:50.413542175 +0000 UTC

[nikpivkin]

@simar7 Why are checks from the advanced folder being skipped? That's why they're not in the bundle checks.

[huornlmj]

+1. Also it does not trigger the KSV-0110? rule when there is no specific namespace mentioned. In these situations the default namespace is defaulted to and Trivy should detect this.

E.g.,
Use the following K8s manifest:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: my-app-container
        image: nginx:latest
        ports:
        - containerPort: 80

Then scan it with trivy in config mode.
The following is reported:

Issues:
HIGH: Container 'my-app-container' of Deployment 'my-app' should set 'securityContext.readOnlyRootFilesystem' to true
HIGH: deployment my-app in default namespace should not set spec.template.spec.containers.ports.containerPort to less than 1024
MEDIUM: container "my-app-container" of deployment "my-app" in "default" namespace should specify a seccomp profile
MEDIUM: Container 'my-app-container' of Deployment 'my-app' should set 'securityContext.allowPrivilegeEscalation' to false
MEDIUM: Container 'my-app-container' of Deployment 'my-app' should set 'securityContext.runAsNonRoot' to true
MEDIUM: Container 'my-app-container' of Deployment 'my-app' should specify an image tag
LOW: Container 'my-app-container' of Deployment 'my-app' should add 'ALL' to 'securityContext.capabilities.drop'
LOW: Container 'my-app-container' of Deployment 'my-app' should set 'resources.limits.cpu'
LOW: Container 'my-app-container' of Deployment 'my-app' should set 'resources.limits.memory'
LOW: Container 'my-app-container' of Deployment 'my-app' should set 'resources.requests.cpu'
LOW: Container 'my-app-container' of Deployment 'my-app' should set 'resources.requests.memory'
LOW: Container 'my-app-container' of Deployment 'my-app' should set 'securityContext.runAsGroup' > 10000
LOW: Container 'my-app-container' of Deployment 'my-app' should set 'securityContext.runAsUser' > 10000
LOW: container should drop all
LOW: Either Pod or Container should set 'securityContext.seccompProfile.type' to 'RuntimeDefault'

Note especially how Trivy does have two rules specific to issues in the use of a default namespace, but KSV-0110 is not thrown.

[simar7]

@simar7 Why are checks from the advanced folder being skipped? That's why they're not in the bundle checks.

Hmm I see - not sure tbh, I don't see why they shouldn't be in the bundle.

@chen-keinan is there any reason why we shouldn't have them in the bundle?

[chen-keinan]

@simar7 Why are checks from the advanced folder being skipped? That's why they're not in the bundle checks.

Hmm I see - not sure tbh, I don't see why they shouldn't be in the bundle.

@chen-keinan is there any reason why we shouldn't have them in the bundle?

@simar7 IMHO it should be included

[simar7]

Closed via aquasecurity/trivy-checks@792e6d4

[itaysk]

@chen-keinan @simar7 what is the "advanced" category? what makes a check "advanced" and who decides that?

[chen-keinan]

Nothing special its just not part of pss and added later following to additional nsa checks

[itaysk]

so basically everything that is not PSS is advanced?
there's also a "general" dir. and also under "advanced" there's "optional".