fix(misconf): Kubernetes Security Check Flagging KSV020 and KSV021 when configured at pod level

[simar7]

We should check spec.securityContext first on a pod level prior as well.

Discussed in #8208

^{Originally posted by gysel January 7, 2025}

Description

This has already been reported as #1187. Back then rule bugs were handled in a different project and the issue has been closed. But the bug still exists and rule bugs seem to be handled in this project meanwhile.

With Pod definition

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 10001
    runAsGroup: 30001
    fsGroup: 20001
    runAsNonRoot: true
  volumes:
  - name: sec-ctx-vol
    emptyDir: {}
  containers:
  - name: sec-ctx-demo
    image: busybox:42
    command: [ "sh", "-c", "sleep 1h" ]
    volumeMounts:
    - name: sec-ctx-vol
      mountPath: /data/demo
    resources:
      requests:
        cpu: 100m
        memory: 128Mi
      limits:
        cpu: 100m
        memory: 128Mi
    securityContext:
      allowPrivilegeEscalation: false
      seccompProfile:
        type: RuntimeDefault
      capabilities:
        drop:
          - ALL
      readOnlyRootFilesystem: true

Desired Behavior

No issues are reported.

Actual Behavior

trivy flags the following issues:

trivy config userid.yaml --report all 
2025-01-07T16:15:45+01:00       INFO    [misconfig] Misconfiguration scanning is enabled
2025-01-07T16:15:46+01:00       INFO    Detected config files   num=1

userid.yaml (kubernetes)

Tests: 93 (SUCCESSES: 91, FAILURES: 2)
Failures: 2 (UNKNOWN: 0, LOW: 2, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

AVD-KSV-0020 (LOW): Container 'sec-ctx-demo' of Pod 'security-context-demo' should set 'securityContext.runAsUser' > 10000
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

See https://avd.aquasec.com/misconfig/ksv020
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 userid.yaml:15-35
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  15 ┌   - name: sec-ctx-demo
  16 │     image: busybox:42
  17 │     command: [ "sh", "-c", "sleep 1h" ]
  18 │     volumeMounts:
  19 │     - name: sec-ctx-vol
  20 │       mountPath: /data/demo
  21 │     resources:
  22 │       requests:
  23 └         cpu: 100m
  ..   
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────


AVD-KSV-0021 (LOW): Container 'sec-ctx-demo' of Pod 'security-context-demo' should set 'securityContext.runAsGroup' > 10000
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

See https://avd.aquasec.com/misconfig/ksv021
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 userid.yaml:15-35
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  15 ┌   - name: sec-ctx-demo
  16 │     image: busybox:42
  17 │     command: [ "sh", "-c", "sleep 1h" ]
  18 │     volumeMounts:
  19 │     - name: sec-ctx-vol
  20 │       mountPath: /data/demo
  21 │     resources:
  22 │       requests:
  23 └         cpu: 100m
  ..   
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Reproduction Steps

n/a

Target

Filesystem

Scanner

Misconfiguration

Output Format

None

Mode

None

Debug Output

n/a

Operating System

any

Version

$ trivy --version
Version: 0.58.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-01-07 12:17:19.537622748 +0000 UTC
  NextUpdate: 2025-01-08 12:17:19.537622377 +0000 UTC
  DownloadedAt: 2025-01-07 14:28:19.180589985 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-12-30 05:06:53.947339247 +0000 UTC
  NextUpdate: 2025-01-02 05:06:53.947339087 +0000 UTC
  DownloadedAt: 2025-01-03 16:58:50.359104369 +0000 UTC
Check Bundle:
  Digest: sha256:f6901e03f486a48f47aa17a78d89d18e6c31ded82aff83ed19d0d73935a1a059
  DownloadedAt: 2025-01-07 14:48:44.292573883 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting