Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: k8s summary separate infra and user finding results #6120

Merged
merged 3 commits into from
Feb 27, 2024
Merged

fix: k8s summary separate infra and user finding results #6120

merged 3 commits into from
Feb 27, 2024

Conversation

chen-keinan
Copy link
Contributor

@chen-keinan chen-keinan commented Feb 13, 2024 •
edited
Loading

Description

k8s summary separate infra and user finding results

Related issues

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).

Example:

Usage:

  • Install kind cluster
  • run : trivy k8s cluster --report summary

Before:


Summary Report for kind-kind


Workload Assessment
┌────────────────────┬────────────────────────────────────────────────┬───────────────────────┬───────────────────┬───────────────────┐
│     Namespace      │                    Resource                    │    Vulnerabilities    │ Misconfigurations │      Secrets      │
│                    │                                                ├────┬────┬────┬────┬───┼───┬───┬───┬───┬───┼───┬───┬───┬───┬───┤
│                    │                                                │ C  │ H  │ M  │ L  │ U │ C │ H │ M │ L │ U │ C │ H │ M │ L │ U │
├────────────────────┼────────────────────────────────────────────────┼────┼────┼────┼────┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┤
│ local-path-storage │ Deployment/local-path-provisioner              │ 4  │ 32 │ 10 │ 2  │   │   │ 1 │ 3 │ 9 │   │   │   │   │   │   │
│ kube-system        │ Pod/kube-scheduler-kind-control-plane          │    │    │    │    │ 5 │   │ 2 │ 4 │ 8 │   │   │   │   │   │   │
│ kube-system        │ Pod/kube-apiserver-kind-control-plane          │    │    │    │    │ 5 │   │ 2 │ 4 │ 9 │   │   │   │   │   │   │
│ kube-system        │ DaemonSet/kindnet                              │ 19 │ 56 │ 57 │ 82 │ 2 │   │ 3 │ 5 │ 5 │   │   │   │   │   │   │
│ kube-system        │ ConfigMap/extension-apiserver-authentication   │    │    │    │    │   │   │   │ 1 │   │   │   │   │   │   │   │
│ kube-system        │ Deployment/coredns                             │    │ 13 │ 10 │ 3  │   │   │ 1 │ 3 │ 4 │   │   │   │   │   │   │
│ kube-system        │ DaemonSet/kube-proxy                           │ 19 │ 45 │ 47 │ 82 │ 2 │   │ 3 │ 4 │ 9 │   │   │   │   │   │   │
│ kube-system        │ Pod/etcd-kind-control-plane                    │    │    │    │    │ 6 │   │ 2 │ 4 │ 7 │   │   │   │   │   │   │
│ kube-system        │ Pod/kube-controller-manager-kind-control-plane │    │    │    │    │ 5 │   │ 2 │ 4 │ 8 │   │   │   │   │   │   │
│ kube-system        │ ControlPlaneComponents/k8s.io/apiserver        │    │    │ 3  │    │   │   │   │   │   │   │   │   │   │   │   │
│                    │ NodeComponents/kind-control-plane              │    │ 4  │ 7  │ 2  │   │   │   │   │   │   │   │   │   │   │   │
└────────────────────┴────────────────────────────────────────────────┴────┴────┴────┴────┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN


RBAC Assessment
┌─────────────┬─────────────────────────────────────────────────────────────────┬───────────────────┐
│  Namespace  │                            Resource                             │  RBAC Assessment  │
│             │                                                                 ├───┬───┬───┬───┬───┤
│             │                                                                 │ C │ H │ M │ L │ U │
├─────────────┼─────────────────────────────────────────────────────────────────┼───┼───┼───┼───┼───┤
│ kube-system │ Role/system:controller:bootstrap-signer                         │   │   │ 1 │   │   │
│ kube-system │ Role/system::leader-locking-kube-scheduler                      │   │   │ 1 │   │   │
│ kube-system │ Role/system:controller:cloud-provider                           │   │   │ 1 │   │   │
│ kube-system │ Role/system::leader-locking-kube-controller-manager             │   │   │ 1 │   │   │
│ kube-system │ Role/system:controller:token-cleaner                            │   │   │ 1 │   │   │
│ kube-public │ Role/system:controller:bootstrap-signer                         │   │   │ 1 │   │   │
│ kube-public │ RoleBinding/kubeadm:bootstrap-signer-clusterinfo                │ 1 │   │   │   │   │
│             │ ClusterRole/admin                                               │ 3 │ 4 │ 6 │   │   │
│             │ ClusterRole/system:controller:node-controller                   │   │   │ 1 │   │   │
│             │ ClusterRole/system:controller:resourcequota-controller          │ 1 │   │   │   │   │
│             │ ClusterRole/system:controller:persistent-volume-binder          │ 1 │ 2 │ 1 │   │   │
│             │ ClusterRole/system:controller:replication-controller            │   │   │ 2 │   │   │
│             │ ClusterRole/system:controller:root-ca-cert-publisher            │   │   │ 1 │   │   │
│             │ ClusterRole/local-path-provisioner-role                         │ 1 │ 1 │ 1 │   │   │
│             │ ClusterRole/system:controller:daemon-set-controller             │   │   │ 1 │   │   │
│             │ ClusterRole/edit                                                │ 2 │ 4 │ 6 │   │   │
│             │ ClusterRole/system:controller:job-controller                    │   │   │ 2 │   │   │
│             │ ClusterRole/system:controller:statefulset-controller            │   │   │ 1 │   │   │
│             │ ClusterRole/system:controller:endpointslicemirroring-controller │   │ 1 │   │   │   │
│             │ ClusterRole/system:controller:ttl-after-finished-controller     │   │   │ 1 │   │   │
│             │ ClusterRole/system:controller:expand-controller                 │ 1 │   │   │   │   │
│             │ ClusterRole/cluster-admin                                       │ 2 │   │   │   │   │
│             │ ClusterRole/system:aggregate-to-admin                           │ 1 │   │   │   │   │
│             │ ClusterRole/system:kube-scheduler                               │   │ 2 │ 1 │   │   │
│             │ ClusterRole/system:aggregate-to-edit                            │ 2 │ 4 │ 6 │   │   │
│             │ ClusterRole/system:controller:cronjob-controller                │   │   │ 3 │   │   │
│             │ ClusterRole/system:controller:horizontal-pod-autoscaler         │ 1 │   │   │   │   │
│             │ ClusterRole/system:node                                         │ 1 │   │ 1 │   │   │
│             │ ClusterRoleBinding/cluster-admin                                │   │   │ 1 │   │   │
│             │ ClusterRole/system:controller:pod-garbage-collector             │   │   │ 1 │   │   │
│             │ ClusterRole/system:controller:replicaset-controller             │   │   │ 2 │   │   │
│             │ ClusterRole/system:kube-controller-manager                      │ 5 │ 2 │   │   │   │
│             │ ClusterRole/system:controller:generic-garbage-collector         │ 1 │   │   │   │   │
│             │ ClusterRole/system:controller:namespace-controller              │ 1 │   │   │   │   │
│             │ ClusterRole/system:controller:deployment-controller             │   │   │ 3 │   │   │
│             │ ClusterRole/system:controller:endpointslice-controller          │   │ 1 │   │   │   │
│             │ ClusterRole/system:controller:endpoint-controller               │   │ 1 │   │   │   │
└─────────────┴─────────────────────────────────────────────────────────────────┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN


Infra Assessment
┌─────────────┬────────────────────────────────────────────────┬─────────────────────────────┐
│  Namespace  │                    Resource                    │ Kubernetes Infra Assessment │
│             │                                                ├─────┬─────┬─────┬─────┬─────┤
│             │                                                │  C  │  H  │  M  │  L  │  U  │
├─────────────┼────────────────────────────────────────────────┼─────┼─────┼─────┼─────┼─────┤
│ kube-system │ Pod/kube-controller-manager-kind-control-plane │     │     │     │ 3   │     │
│ kube-system │ Pod/kube-apiserver-kind-control-plane          │     │     │ 1   │ 8   │     │
│ kube-system │ Pod/kube-scheduler-kind-control-plane          │     │     │     │ 1   │     │
│             │ NodeInfo/kind-control-plane                    │  1  │ 4   │     │ 1   │     │
└─────────────┴────────────────────────────────────────────────┴─────┴─────┴─────┴─────┴─────┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN

After:


Summary Report for kind-kind


Workload Assessment
┌────────────────────┬───────────────────────────────────┬─────────────────────┬───────────────────┬───────────────────┐
│     Namespace      │             Resource              │   Vulnerabilities   │ Misconfigurations │      Secrets      │
│                    │                                   ├───┬────┬────┬───┬───┼───┬───┬───┬───┬───┼───┬───┬───┬───┬───┤
│                    │                                   │ C │ H  │ M  │ L │ U │ C │ H │ M │ L │ U │ C │ H │ M │ L │ U │
├────────────────────┼───────────────────────────────────┼───┼────┼────┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┤
│ local-path-storage │ Deployment/local-path-provisioner │ 4 │ 32 │ 10 │ 2 │   │   │ 1 │ 3 │ 9 │   │   │   │   │   │   │
└────────────────────┴───────────────────────────────────┴───┴────┴────┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN


Infra Assessment
┌─────────────┬────────────────────────────────────────────────┬───────────────────────┬────────────────────┬───────────────────┐
│  Namespace  │                    Resource                    │    Vulnerabilities    │ Misconfigurations  │      Secrets      │
│             │                                                ├────┬────┬────┬────┬───┼───┬───┬───┬────┬───┼───┬───┬───┬───┬───┤
│             │                                                │ C  │ H  │ M  │ L  │ U │ C │ H │ M │ L  │ U │ C │ H │ M │ L │ U │
├─────────────┼────────────────────────────────────────────────┼────┼────┼────┼────┼───┼───┼───┼───┼────┼───┼───┼───┼───┼───┼───┤
│ kube-system │ DaemonSet/kindnet                              │ 19 │ 56 │ 57 │ 82 │ 2 │   │ 3 │ 5 │ 5  │   │   │   │   │   │   │
│ kube-system │ Pod/kube-scheduler-kind-control-plane          │    │    │    │    │ 5 │   │ 2 │ 4 │ 9  │   │   │   │   │   │   │
│ kube-system │ DaemonSet/kube-proxy                           │ 19 │ 45 │ 47 │ 82 │ 2 │   │ 3 │ 4 │ 9  │   │   │   │   │   │   │
│ kube-system │ ControlPlaneComponents/k8s.io/apiserver        │    │    │ 3  │    │   │   │   │   │    │   │   │   │   │   │   │
│ kube-system │ Pod/etcd-kind-control-plane                    │    │    │    │    │ 6 │   │ 2 │ 4 │ 7  │   │   │   │   │   │   │
│ kube-system │ Deployment/coredns                             │    │ 13 │ 10 │ 3  │   │   │ 1 │ 3 │ 4  │   │   │   │   │   │   │
│ kube-system │ Pod/kube-apiserver-kind-control-plane          │    │    │    │    │ 5 │   │ 2 │ 5 │ 17 │   │   │   │   │   │   │
│ kube-system │ ConfigMap/extension-apiserver-authentication   │    │    │    │    │   │   │   │ 1 │    │   │   │   │   │   │   │
│ kube-system │ Pod/kube-controller-manager-kind-control-plane │    │    │    │    │ 5 │   │ 2 │ 4 │ 11 │   │   │   │   │   │   │
│             │ Node/kind-control-plane                        │    │ 4  │ 7  │ 2  │   │ 1 │ 4 │   │ 1  │   │   │   │   │   │   │
└─────────────┴────────────────────────────────────────────────┴────┴────┴────┴────┴───┴───┴───┴───┴────┴───┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN


RBAC Assessment
┌─────────────┬─────────────────────────────────────────────────────────────────┬───────────────────┐
│  Namespace  │                            Resource                             │  RBAC Assessment  │
│             │                                                                 ├───┬───┬───┬───┬───┤
│             │                                                                 │ C │ H │ M │ L │ U │
├─────────────┼─────────────────────────────────────────────────────────────────┼───┼───┼───┼───┼───┤
│ kube-system │ Role/system:controller:cloud-provider                           │   │   │ 1 │   │   │
│ kube-system │ Role/system:controller:token-cleaner                            │   │   │ 1 │   │   │
│ kube-system │ Role/system:controller:bootstrap-signer                         │   │   │ 1 │   │   │
│ kube-system │ Role/system::leader-locking-kube-scheduler                      │   │   │ 1 │   │   │
│ kube-system │ Role/system::leader-locking-kube-controller-manager             │   │   │ 1 │   │   │
│ kube-public │ RoleBinding/kubeadm:bootstrap-signer-clusterinfo                │ 1 │   │   │   │   │
│ kube-public │ Role/system:controller:bootstrap-signer                         │   │   │ 1 │   │   │
│             │ ClusterRole/system:controller:replication-controller            │   │   │ 2 │   │   │
│             │ ClusterRole/system:controller:job-controller                    │   │   │ 2 │   │   │
│             │ ClusterRole/system:controller:persistent-volume-binder          │ 1 │ 2 │ 1 │   │   │
│             │ ClusterRole/system:controller:resourcequota-controller          │ 1 │   │   │   │   │
│             │ ClusterRole/system:controller:endpoint-controller               │   │ 1 │   │   │   │
│             │ ClusterRole/system:controller:deployment-controller             │   │   │ 3 │   │   │
│             │ ClusterRole/system:controller:endpointslice-controller          │   │ 1 │   │   │   │
│             │ ClusterRole/admin                                               │ 3 │ 4 │ 6 │   │   │
│             │ ClusterRoleBinding/cluster-admin                                │   │   │ 1 │   │   │
│             │ ClusterRole/system:controller:horizontal-pod-autoscaler         │ 1 │   │   │   │   │
│             │ ClusterRole/system:kube-scheduler                               │   │ 2 │ 1 │   │   │
│             │ ClusterRole/system:controller:root-ca-cert-publisher            │   │   │ 1 │   │   │
│             │ ClusterRole/edit                                                │ 2 │ 4 │ 6 │   │   │
│             │ ClusterRole/system:controller:namespace-controller              │ 1 │   │   │   │   │
│             │ ClusterRole/system:node                                         │ 1 │   │ 1 │   │   │
│             │ ClusterRole/cluster-admin                                       │ 2 │   │   │   │   │
│             │ ClusterRole/system:controller:cronjob-controller                │   │   │ 3 │   │   │
│             │ ClusterRole/system:controller:endpointslicemirroring-controller │   │ 1 │   │   │   │
│             │ ClusterRole/system:controller:daemon-set-controller             │   │   │ 1 │   │   │
│             │ ClusterRole/system:controller:generic-garbage-collector         │ 1 │   │   │   │   │
│             │ ClusterRole/system:controller:pod-garbage-collector             │   │   │ 1 │   │   │
│             │ ClusterRole/system:controller:node-controller                   │   │   │ 1 │   │   │
│             │ ClusterRole/system:kube-controller-manager                      │ 5 │ 2 │   │   │   │
│             │ ClusterRole/system:controller:replicaset-controller             │   │   │ 2 │   │   │
│             │ ClusterRole/system:controller:statefulset-controller            │   │   │ 1 │   │   │
│             │ ClusterRole/system:aggregate-to-edit                            │ 2 │ 4 │ 6 │   │   │
│             │ ClusterRole/system:aggregate-to-admin                           │ 1 │   │   │   │   │
│             │ ClusterRole/local-path-provisioner-role                         │ 1 │ 1 │ 1 │   │   │
│             │ ClusterRole/system:controller:ttl-after-finished-controller     │   │   │ 1 │   │   │
│             │ ClusterRole/system:controller:expand-controller                 │ 1 │   │   │   │   │
└─────────────┴─────────────────────────────────────────────────────────────────┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN

@chen-keinan
Copy link
Contributor Author

@itaysk see example of summary table , before and after , let me know if you have any comments

@chen-keinan chen-keinan force-pushed the fix/k8s-summary-seperate-infra-and-user-test branch 6 times, most recently from ef66763 to c921d57 Compare February 15, 2024 15:07
@chen-keinan chen-keinan marked this pull request as ready for review February 18, 2024 07:19
@knqyf263 knqyf263 removed their request for review February 19, 2024 11:49
@knqyf263
Copy link
Collaborator

knqyf263 commented Feb 21, 2024 •
edited
Loading

@chen-keinan Can you please write down how to test it?
e.g.

$ kind create cluster
$ mage build
$ ./trivy k8s cluster

Then, you can ask @simar7, @DmitriyLewen or @nikpivkin to review this PR.

@chen-keinan chen-keinan requested a review from simar7 February 21, 2024 11:47
@chen-keinan
Copy link
Contributor Author

@simar7 please have a look at the PR

simar7
simar7 reviewed Feb 23, 2024
View reviewed changes
pkg/k8s/report/report.go Outdated Show resolved Hide resolved
@simar7
Copy link
Member

simar7 commented Feb 23, 2024

Should we omit the table if there isn't anything in it? For example I get this with my cluster.

Workload Assessment
┌───────────┬──────────┬───────────────────┬───────────────────┬───────────────────┐
│ Namespace │ Resource │  Vulnerabilities  │ Misconfigurations │      Secrets      │
│           │          ├───┬───┬───┬───┬───┼───┬───┬───┬───┬───┼───┬───┬───┬───┬───┤
│           │          │ C │ H │ M │ L │ U │ C │ H │ M │ L │ U │ C │ H │ M │ L │ U │
└───────────┴──────────┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN

@chen-keinan
fix: k8s summary separate infra and user finding results
92e553c 
Signed-off-by: chenk <hen.keinan@gmail.com>
@chen-keinan
fix: k8s summary separate infra and user finding results
3ecfabd 
Signed-off-by: chenk <hen.keinan@gmail.com>
@chen-keinan chen-keinan force-pushed the fix/k8s-summary-seperate-infra-and-user-test branch from 177abbb to 3ecfabd Compare February 25, 2024 08:36
@chen-keinan
fix: update rbac resource condition
70e079b 
Signed-off-by: chenk <hen.keinan@gmail.com>
@chen-keinan
Copy link
Contributor Author

Should we omit the table if there isn't anything in it? For example I get this with my cluster.

Workload Assessment
┌───────────┬──────────┬───────────────────┬───────────────────┬───────────────────┐
│ Namespace │ Resource │  Vulnerabilities  │ Misconfigurations │      Secrets      │
│           │          ├───┬───┬───┬───┬───┼───┬───┬───┬───┬───┼───┬───┬───┬───┬───┤
│           │          │ C │ H │ M │ L │ U │ C │ H │ M │ L │ U │ C │ H │ M │ L │ U │
└───────────┴──────────┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN

@simar7 yes , we do want to show empty table when no results

@chen-keinan
Copy link
Contributor Author

@simar7 thanks for the feedback , all comments has been addressed

@chen-keinan chen-keinan requested a review from simar7 February 25, 2024 08:41
@knqyf263 knqyf263 added this pull request to the merge queue Feb 27, 2024
Merged via the queue into aquasecurity:main with commit dc76c6e Feb 27, 2024
12 checks passed
@aqua-bot aqua-bot mentioned this pull request May 29, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@simar7 simar7 simar7 approved these changes

@josedonizetti josedonizetti Awaiting requested review from josedonizetti

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

k8s summary separate infra and user finding results
3 participants
@chen-keinan @knqyf263 @simar7