Querying out specific env vars defined in Kubernetes workloads

[tas50]

Mondoo 6.17 added env and envFrom data to container resources in Kubernetes. I'd like to use those to look for potentially dangerous env vars that are passing in secrets in plain text.

Give this workload:

apiVersion: v1
kind: Pod
metadata:
  name: luna-frontend
  namespace: foo
spec:
  containers:
  - name: luna-frontend
    image: lunalectric/frontend:1.0
    env:
    - name: LOGIN
      value: "oh_no"
    - name: PASSWORD
      value: "they_are_really_doing_this!"

Using mondoo shell k8s --path env.yaml I got to the point of exposing the env vars, but how do I check for multiple names here:

mondoo> k8s.pods[0].containers[0].env
k8s.pods[0].containers[0].env: [
  0: {
    name: "LOGIN"
    value: "oh_no"
  }
  1: {
    name: "PASSWORD"
    value: "they_are_really_doing_this!"
  }
]

[arlimus]

Great question! The recommended way to approach these is to find a check that works well for one item and then translate it to apply to all of them.

1. Check for dangerous ENV variables

Given any one container (like the one you used in your example), we can write a query to look at its properties like so:

k8s.pods[0].containers[0] {
   ...
}

This check can now be written with the new env field. Let's look for the two you have in your example: LOGIN and PASSWORD and make sure that neither is set:

k8s.pods[0].containers[0] {
   env["LOGIN"] == null && env["PASSWORD"] == null
}

2. Applying it to all assets

Now that we have the assertion, we can apply this to all assets. In your case, you are looking at pods and all the containers inside of pods.

A great way to write this check is to use all, which makes sure that all of the checks you provide it are true.

k8s.pods.all(  
  containers.all ( ... make sure this is true ... )
)

Solution

If you apply this to your use-case:

k8s.pods.all( 
  containers.all(  
     env["LOGIN"] == null && env["PASSWORD"] == null
  )
)

... and that prints:

[failed] [].all()
  actual:   [
    0: k8s.pod id = pod:foo:luna-frontend
  ]