Trivy scanne désormais les clusters Kubernetes
· 20 minutes de lecture
Consultant DevOps
Trivy fait partie de ma liste d'outils que j'utilise couramment sur poste de développement. Pour ceux qui ne connaissent pas Trivy, il s'agit d'un outil d'audit de sécurité tout-en-un pour les conteneurs. La dernière version apporte l'audit CIS des clusters kubernetes.
Rappel : CIS est une organisation sans but lucratif qui fournit des
recommandations sur les meilleures pratiques en matière de sécurité. Ils
fournissent par exemple, un ensemble de recommandations pour la configuration
des clusters Kubernetes. Pour auditer les instances, le CIS fournit un outil qui
répond au nom de kube-bench qui n'examinent pas que la configuration de
l'instance, mais aussi tous les composants (api, etcd, ...) Kubernetes
installés et les workloads en cours.
Mais pourquoi ne pas utiliser directement kube-bench ? Tout simplement parce que
trivy est un outil tout-en-un ! Trivy permet d'auditer par exemple une AMI
AWS. On peut ainsi l'utiliser dans plusieurs taches de notre pipeline CI.
Installation de Trivy
Comme toujours, je vais utiliser asdf pour l'installer.
asdf plugin add trivy
asdf install trivy latest
asdf global trivy latest
trivy --version
Version: 0.41.0
Vulnerability DB:
Version: 2
UpdatedAt: 2023-05-04 06:07:08.305637983 +0000 UTC
NextUpdate: 2023-05-04 12:07:08.305637583 +0000 UTC
DownloadedAt: 2023-05-04 06:39:18.160466835 +0000 UTC
Policy Bundle:
Digest: sha256:c38f14ef04a03dfa0cc25a587c7bf17482914233f26c8523a676a5dda633e6de
DownloadedAt: 2023-05-04 06:39:19.083167698 +0000 UTC
Audit d'un cluster
Je vais tester trivy sur mon instance kubernetes qui tourne sous k3s.
L'option à utiliser pour auditer un cluster est k8s.
trivy k8s --help
[EXPERIMENTAL] Scan kubernetes cluster
Usage:
trivy kubernetes [flags] { cluster | all | specific resources like kubectl. eg: pods, pod/NAME }
Aliases:
kubernetes, k8s
Examples:
# cluster scanning
$ trivy k8s --report summary cluster
# namespace scanning:
$ trivy k8s -n kube-system --report summary all
# resources scanning:
$ trivy k8s --report=summary deploy
$ trivy k8s --namespace=kube-system --report=summary deploy,configmaps
# resource scanning:
$ trivy k8s deployment/orion
Audit par défaut
Testons la première commande permettant de faire un audit complet :
trivy k8s --report summary cluster
2023-05-05T10:07:36.085+0200 INFO Need to update DB
2023-05-05T10:07:36.085+0200 INFO DB Repository: ghcr.io/aquasecurity/trivy-db
2023-05-05T10:07:36.085+0200 INFO Downloading DB...
15.88 MiB / 36.56 MiB [------------------------------------------>______________________________________________________] 43.42% 1.36 MiB p/s E36.56 MiB / 36.56 MiB [----------------------------------------------------------------------------------------------] 100.00% 1.70 MiB p/s 22s
40.27 KiB / 40.27 KiB [------------------------------------------------------------------------------------------------------] 100.00% ? p/s 0s
210 / 210 [---------------------------------------------------------------------------------------------------------------------] 100.00% 1 p/s
Summary Report for default
Workload Assessment
┌─────────────┬──────────────────────────────────────────────┬─────────────────────┬────────────────────┬───────────────────┐
│ Namespace │ Resource │ Vulnerabilities │ Misconfigurations │ Secrets │
│ │ ├───┬────┬────┬───┬───┼───┬───┬───┬────┬───┼───┬───┬───┬───┬───┤
│ │ │ C │ H │ M │ L │ U │ C │ H │ M │ L │ U │ C │ H │ M │ L │ U │
├─────────────┼──────────────────────────────────────────────┼───┼────┼────┼───┼───┼───┼───┼───┼────┼───┼───┼───┼───┼───┼───┤
│ kube-system │ ConfigMap/chart-values-traefik │ │ │ │ │ │ │ 1 │ │ │ │ │ │ │ │ │
│ kube-system │ DaemonSet/svclb-traefik-dd199f1d │ │ │ │ │ │ │ 4 │ 7 │ 20 │ │ │ │ │ │ │
│ kube-system │ Deployment/coredns │ │ 1 │ 1 │ 1 │ 1 │ │ │ 2 │ 5 │ │ │ │ │ │ │
│ kube-system │ Deployment/metrics-server │ 1 │ 3 │ 2 │ │ 1 │ │ │ │ 7 │ │ │ │ │ │ │
│ kube-system │ ConfigMap/extension-apiserver-authentication │ │ │ │ │ │ │ 1 │ │ │ │ │ │ │ │ │
│ kube-system │ Deployment/traefik │ │ 14 │ 11 │ 2 │ 1 │ │ │ 1 │ 5 │ │ │ │ │ │ │
│ kube-system │ Job/helm-install-traefik │ │ 7 │ 9 │ 1 │ 2 │ │ │ 2 │ 10 │ │ │ │ │ │ │
│ kube-system │ Deployment/local-path-provisioner │ │ 3 │ 7 │ │ │ │ │ 2 │ 10 │ │ │ │ │ │ │
│ kube-system │ Job/helm-install-traefik-crd │ │ 7 │ 9 │ 1 │ 2 │ │ │ 2 │ 10 │ │ │ │ │ │ │
└─────────────┴──────────────────────────────────────────────┴───┴────┴────┴───┴───┴───┴───┴───┴────┴───┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN
RBAC Assessment
┌─────────────┬─────────────────────────────────────────────────────────────────┬───────────────────┐
│ Namespace │ Resource │ RBAC Assessment │
│ │ ├───┬───┬───┬───┬───┤
│ │ │ C │ H │ M │ L │ U │
├─────────────┼─────────────────────────────────────────────────────────────────┼───┼───┼───┼───┼───┤
│ kube-system │ Role/system::leader-locking-kube-scheduler │ │ │ 1 │ │ │
│ kube-system │ Role/system:controller:cloud-provider │ │ │ 1 │ │ │
│ kube-system │ Role/system:controller:bootstrap-signer │ 1 │ │ │ │ │
│ kube-system │ Role/system:controller:token-cleaner │ 1 │ │ │ │ │
│ kube-system │ Role/system::leader-locking-kube-controller-manager │ │ │ 1 │ │ │
│ kube-public │ Role/system:controller:bootstrap-signer │ │ │ 1 │ │ │
│ │ ClusterRole/system:controller:persistent-volume-binder │ 1 │ 2 │ │ │ │
│ │ ClusterRole/admin │ 3 │ 7 │ 1 │ │ │
│ │ ClusterRole/system:controller:root-ca-cert-publisher │ │ │ 1 │ │ │
│ │ ClusterRole/cluster-admin │ 2 │ │ │ │ │
│ │ ClusterRole/system:controller:endpointslice-controller │ │ 1 │ │ │ │
│ │ ClusterRole/system:controller:endpointslicemirroring-controller │ │ 1 │ │ │ │
│ │ ClusterRole/system:controller:resourcequota-controller │ 1 │ │ │ │ │
│ │ ClusterRole/system:kube-scheduler │ │ 2 │ │ │ │
│ │ ClusterRole/edit │ 2 │ 7 │ 1 │ │ │
│ │ ClusterRole/system:kube-controller-manager │ 5 │ 2 │ │ │ │
│ │ ClusterRoleBinding/helm-kube-system-traefik-crd │ │ │ 1 │ │ │
│ │ ClusterRole/system:controller:replicaset-controller │ │ 1 │ │ │ │
│ │ ClusterRole/system:controller:horizontal-pod-autoscaler │ 2 │ │ │ │ │
│ │ ClusterRole/system:controller:cronjob-controller │ │ 2 │ │ │ │
│ │ ClusterRole/system:controller:deployment-controller │ │ 2 │ │ │ │
│ │ ClusterRole/system:controller:replication-controller │ │ 1 │ │ │ │
│ │ ClusterRole/k3s-cloud-controller-manager │ 1 │ 2 │ │ │ │
│ │ ClusterRole/system:controller:namespace-controller │ 1 │ │ │ │ │
│ │ ClusterRole/system:node │ 1 │ │ │ │ │
│ │ ClusterRole/system:controller:job-controller │ │ 1 │ │ │ │
│ │ ClusterRole/traefik-kube-system │ 1 │ │ │ │ │
│ │ ClusterRole/system:controller:endpoint-controller │ │ 1 │ │ │ │
│ │ ClusterRole/system:controller:generic-garbage-collector │ 1 │ │ │ │ │
│ │ ClusterRole/system:controller:expand-controller │ 1 │ │ │ │ │
│ │ ClusterRole/system:aggregate-to-edit │ 2 │ 7 │ 1 │ │ │
│ │ ClusterRole/system:aggregate-to-admin │ 1 │ │ │ │ │
│ │ ClusterRole/local-path-provisioner-role │ 1 │ 1 │ │ │ │
│ │ ClusterRoleBinding/helm-kube-system-traefik │ │ │ 1 │ │ │
└─────────────┴─────────────────────────────────────────────────────────────────┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN
Infra Assessment
┌───────────┬──────────┬─────────────────────────────┐
│ Namespace │ Resource │ Kubernetes Infra Assessment │
│ │ ├─────┬─────┬─────┬─────┬─────┤
│ │ │ C │ H │ M │ L │ U │
└───────────┴──────────┴─────┴─────┴─────┴─────┴─────┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN
Je mets à jour régulièrement k3s. On peut voir que la dernière version stable
contient un composant possédant une faille critique. Comment obtenir plus d'info
dessus ?
Je demande donc de scanner la ressource Deployment/metrics-server tournant
dans le namespace kube-system. Je demande de formater la sortie au format json
et d'afficher seulement que les failles de type CRITICAL :
trivy k8s -n kube-system Deployment/metrics-server -s CRITICAL -f json
1 / 1 [-------------------------------------------------------------------------------------------------------------------------] 100.00% 0 p/s
{
"ClusterName": "default",
"Vulnerabilities": [
{
"Namespace": "kube-system",
"Kind": "Deployment",
"Name": "metrics-server",
"Results": [
{
"Target": "rancher/mirrored-metrics-server:v0.6.2 (debian 11.5)",
"Class": "os-pkgs",
"Type": "debian"
},
{
"Target": "metrics-server",
"Class": "lang-pkgs",
"Type": "gobinary",
"Vulnerabilities": [
{
"VulnerabilityID": "CVE-2022-1996",
"PkgName": "github.com/emicklei/go-restful",
"InstalledVersion": "v2.9.5+incompatible",
"FixedVersion": "2.16.0",
"Layer": {
"Digest": "sha256:81c08c324550fd5d554064975aed9e5754d767a7ffa4557617edf4ce3caf95d7",
"DiffID": "sha256:dc5ecd167a1505e8ffdc08f32c9e83b2cfee102339f819e52583aadfc2741e60"
},
"SeveritySource": "ghsa",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-1996",
"DataSource": {
"ID": "go-vulndb",
"Name": "The Go Vulnerability Database",
"URL": "https://github.com/golang/vulndb"
},
"Title": "go-restful: Authorization Bypass Through User-Controlled Key",
"Description": "Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.",
"Severity": "CRITICAL",
"CweIDs": [
"CWE-639"
],
"CVSS": {
"ghsa": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"V3Score": 9.1
},
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"V2Score": 6.4,
"V3Score": 9.1
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"V3Score": 9.1
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-1996",
"https://github.com/advisories/GHSA-r48q-9g5r-8q2h",
"https://github.com/emicklei/go-restful/commit/926662532deb450272956c7bc573978464aae74e",
"https://github.com/emicklei/go-restful/commit/f292efff46ae17e9d104f865a60a39a2ae9402f1",
"https://github.com/emicklei/go-restful/commit/fd3c327a379ce08c68ef18765bdc925f5d9bad10",
"https://github.com/emicklei/go-restful/issues/489",
"https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SO5QC2JFW2PXBWAE27OYYYL5SPFUBHTY/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W56PP46JVZEKCANBKXFKRVSBBRRMCY6V/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGQKWD6SE75PFBPFVSZYAKAVXKBZXKWS/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/",
"https://nvd.nist.gov/vuln/detail/CVE-2022-1996",
"https://pkg.go.dev/vuln/GO-2022-0619",
"https://security.netapp.com/advisory/ntap-20220923-0005/",
"https://www.cve.org/CVERecord?id=CVE-2022-1996"
],
"PublishedDate": "2022-06-08T13:15:00Z",
"LastModifiedDate": "2023-02-23T04:15:00Z"
}
]
}
]
}
],
"Misconfigurations": [
{
"Namespace": "kube-system",
"Kind": "Deployment",
"Name": "metrics-server",
"Results": [
{
"Target": "Deployment/metrics-server",
"Class": "config",
"Type": "kubernetes",
"MisconfSummary": {
"Successes": 19,
"Failures": 0,
"Exceptions": 0
}
}
]
}
]
}
Audit CIS
Pour demander l'audit CIS, il faut ajouter l'extension --compliance=k8s-cis.
Trivy permet d'auditer pour répondre à d'autres types de compliances :
- k8s-nsa
- k8s-cis
- k8s-pss-baseline
- k8s-pss-restricted
Lançons l'audit CIS :
trivy k8s cluster --compliance=k8s-cis --report summary
210 / 210 [---------------------------------------------------------------------------------------------------------------------] 100.00% 1 p/s
Summary Report for compliance: CIS Kubernetes Benchmarks v1.23
┌────────┬──────────┬─────────────────────────────────────────────────────────────────────────────────────────────────────────────────┬────────┬────────┐
│ ID │ Severity │ Control Name │ Status │ Issues │
├────────┼──────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼────────┤
│ 1.1.1 │ HIGH │ Ensure that the API server pod specification file permissions are set to 600 or more restrictive │ PASS │ 0 │
│ 1.1.2 │ HIGH │ Ensure that the API server pod specification file ownership is set to root:root │ PASS │ 0 │
│ 1.1.3 │ HIGH │ Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive │ PASS │ 0 │
│ 1.1.4 │ HIGH │ Ensure that the controller manager pod specification file ownership is set to root:root │ PASS │ 0 │
│ 1.1.5 │ HIGH │ Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive │ PASS │ 0 │
│ 1.1.6 │ HIGH │ Ensure that the scheduler pod specification file ownership is set to root:root │ PASS │ 0 │
│ 1.1.7 │ HIGH │ Ensure that the etcd pod specification file permissions are set to 600 or more restrictive │ PASS │ 0 │
│ 1.1.8 │ HIGH │ Ensure that the etcd pod specification file ownership is set to root:root │ PASS │ 0 │
│ 1.1.9 │ HIGH │ Ensure that the Container Network Interface file permissions are set to 600 or more restrictive │ PASS │ 0 │
│ 1.1.10 │ HIGH │ Ensure that the Container Network Interface file ownership is set to root:root │ PASS │ 0 │
│ 1.1.11 │ HIGH │ Ensure that the etcd data directory permissions are set to 700 or more restrictive │ PASS │ 0 │
│ 1.1.12 │ LOW │ Ensure that the etcd data directory ownership is set to etcd:etcd │ PASS │ 0 │
│ 1.1.13 │ CRITICAL │ Ensure that the admin.conf file permissions are set to 600 │ PASS │ 0 │
│ 1.1.14 │ CRITICAL │ Ensure that the admin.conf file ownership is set to root:root │ PASS │ 0 │
│ 1.1.15 │ HIGH │ Ensure that the scheduler.conf file permissions are set to 600 or more restrictive │ PASS │ 0 │
│ 1.1.16 │ HIGH │ Ensure that the scheduler.conf file ownership is set to root:root │ PASS │ 0 │
│ 1.1.17 │ HIGH │ Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive │ PASS │ 0 │
│ 1.1.18 │ HIGH │ Ensure that the controller-manager.conf file ownership is set to root:root │ PASS │ 0 │
│ 1.1.19 │ CRITICAL │ Ensure that the Kubernetes PKI directory and file ownership is set to root:root │ PASS │ 0 │
│ 1.1.20 │ CRITICAL │ Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive │ PASS │ 0 │
│ 1.1.21 │ CRITICAL │ Ensure that the Kubernetes PKI key file permissions are set to 600 │ PASS │ 0 │
│ 1.2.1 │ MEDIUM │ Ensure that the --anonymous-auth argument is set to false │ PASS │ 0 │
│ 1.2.2 │ LOW │ Ensure that the --token-auth-file parameter is not set │ PASS │ 0 │
│ 1.2.3 │ LOW │ Ensure that the --DenyServiceExternalIPs is not set │ PASS │ 0 │
│ 1.2.4 │ LOW │ Ensure that the --kubelet-https argument is set to true │ PASS │ 0 │
│ 1.2.5 │ HIGH │ Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate │ PASS │ 0 │
│ 1.2.6 │ HIGH │ Ensure that the --kubelet-certificate-authority argument is set as appropriate │ PASS │ 0 │
│ 1.2.7 │ LOW │ Ensure that the --authorization-mode argument is not set to AlwaysAllow │ PASS │ 0 │
│ 1.2.8 │ HIGH │ Ensure that the --authorization-mode argument includes Node │ PASS │ 0 │
│ 1.2.9 │ HIGH │ Ensure that the --authorization-mode argument includes RBAC │ PASS │ 0 │
│ 1.2.10 │ HIGH │ Ensure that the admission control plugin EventRateLimit is set │ PASS │ 0 │
│ 1.2.11 │ LOW │ Ensure that the admission control plugin AlwaysAdmit is not set │ PASS │ 0 │
│ 1.2.12 │ MEDIUM │ Ensure that the admission control plugin AlwaysPullImages is set │ PASS │ 0 │
│ 1.2.13 │ MEDIUM │ Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used │ PASS │ 0 │
│ 1.2.14 │ LOW │ Ensure that the admission control plugin ServiceAccount is set │ PASS │ 0 │
│ 1.2.15 │ LOW │ Ensure that the admission control plugin NamespaceLifecycle is set │ PASS │ 0 │
│ 1.2.16 │ LOW │ Ensure that the admission control plugin NodeRestriction is set │ PASS │ 0 │
│ 1.2.17 │ HIGH │ Ensure that the --secure-port argument is not set to 0 │ PASS │ 0 │
│ 1.2.18 │ LOW │ Ensure that the --profiling argument is set to false │ PASS │ 0 │
│ 1.2.19 │ LOW │ Ensure that the --audit-log-path argument is set │ PASS │ 0 │
│ 1.2.20 │ LOW │ Ensure that the --audit-log-maxage argument is set to 30 or as appropriate │ PASS │ 0 │
│ 1.2.21 │ LOW │ Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate │ PASS │ 0 │
│ 1.2.22 │ LOW │ Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate │ PASS │ 0 │
│ 1.2.24 │ LOW │ Ensure that the --service-account-lookup argument is set to true │ PASS │ 0 │
│ 1.2.25 │ LOW │ Ensure that the --service-account-key-file argument is set as appropriate │ PASS │ 0 │
│ 1.2.26 │ LOW │ Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate │ PASS │ 0 │
│ 1.2.27 │ MEDIUM │ Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate │ PASS │ 0 │
│ 1.2.28 │ LOW │ Ensure that the --client-ca-file argument is set appropriate │ PASS │ 0 │
│ 1.2.29 │ LOW │ Ensure that the --etcd-cafile argument is set as appropriate │ PASS │ 0 │
│ 1.2.30 │ LOW │ Ensure that the --encryption-provider-config argument is set as appropriate │ PASS │ 0 │
│ 1.3.1 │ MEDIUM │ Ensure that the --terminated-pod-gc-threshold argument is set as appropriate │ PASS │ 0 │
│ 1.3.3 │ MEDIUM │ Ensure that the --use-service-account-credentials argument is set to true │ PASS │ 0 │
│ 1.3.4 │ MEDIUM │ Ensure that the --service-account-private-key-file argument is set as appropriate │ PASS │ 0 │
│ 1.3.5 │ MEDIUM │ Ensure that the --root-ca-file argument is set as appropriate │ PASS │ 0 │
│ 1.3.6 │ MEDIUM │ Ensure that the RotateKubeletServerCertificate argument is set to true │ PASS │ 0 │
│ 1.3.7 │ LOW │ Ensure that the --bind-address argument is set to 127.0.0.1 │ PASS │ 0 │
│ 1.4.1 │ MEDIUM │ Ensure that the --profiling argument is set to false │ PASS │ 0 │
│ 1.4.2 │ CRITICAL │ Ensure that the --bind-address argument is set to 127.0.0.1 │ PASS │ 0 │
│ 2.1 │ MEDIUM │ Ensure that the --cert-file and --key-file arguments are set as appropriate │ PASS │ 0 │
│ 2.2 │ CRITICAL │ Ensure that the --client-cert-auth argument is set to true │ PASS │ 0 │
│ 2.3 │ CRITICAL │ Ensure that the --auto-tls argument is not set to true │ PASS │ 0 │
│ 2.4 │ CRITICAL │ Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate │ PASS │ 0 │
│ 2.5 │ CRITICAL │ Ensure that the --peer-client-cert-auth argument is set to true │ PASS │ 0 │
│ 2.6 │ HIGH │ Ensure that the --peer-auto-tls argument is not set to true │ PASS │ 0 │
│ 3.1.1 │ HIGH │ Client certificate authentication should not be used for users (Manual) │ - │ - │
│ 3.2.1 │ HIGH │ Ensure that a minimal audit policy is created (Manual) │ - │ - │
│ 3.2.2 │ HIGH │ Ensure that the audit policy covers key security concerns (Manual) │ - │ - │
│ 4.1.1 │ HIGH │ Ensure that the kubelet service file permissions are set to 600 or more restrictive │ PASS │ 0 │
│ 4.1.2 │ HIGH │ Ensure that the kubelet service file ownership is set to root:root │ PASS │ 0 │
│ 4.1.3 │ HIGH │ If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive │ PASS │ 0 │
│ 4.1.4 │ HIGH │ If proxy kubeconfig file exists ensure ownership is set to root:root │ PASS │ 0 │
│ 4.1.5 │ HIGH │ Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive │ PASS │ 0 │
│ 4.1.6 │ HIGH │ Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root │ PASS │ 0 │
│ 4.1.7 │ CRITICAL │ Ensure that the certificate authorities file permissions are set to 600 or more restrictive │ PASS │ 0 │
│ 4.1.8 │ CRITICAL │ Ensure that the client certificate authorities file ownership is set to root:root │ PASS │ 0 │
│ 4.1.9 │ HIGH │ If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive │ PASS │ 0 │
│ 4.1.10 │ HIGH │ If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root │ PASS │ 0 │
│ 4.2.1 │ CRITICAL │ Ensure that the --anonymous-auth argument is set to false │ PASS │ 0 │
│ 4.2.2 │ CRITICAL │ Ensure that the --authorization-mode argument is not set to AlwaysAllow │ PASS │ 0 │
│ 4.2.3 │ CRITICAL │ Ensure that the --client-ca-file argument is set as appropriate │ PASS │ 0 │
│ 4.2.4 │ HIGH │ Verify that the --read-only-port argument is set to 0 │ PASS │ 0 │
│ 4.2.5 │ HIGH │ Ensure that the --streaming-connection-idle-timeout argument is not set to 0 │ PASS │ 0 │
│ 4.2.6 │ HIGH │ Ensure that the --protect-kernel-defaults argument is set to true │ PASS │ 0 │
│ 4.2.7 │ HIGH │ Ensure that the --make-iptables-util-chains argument is set to true │ PASS │ 0 │
│ 4.2.8 │ HIGH │ Ensure that the --hostname-override argument is not set │ PASS │ 0 │
│ 4.2.9 │ HIGH │ Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture │ PASS │ 0 │
│ 4.2.10 │ CRITICAL │ Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate │ PASS │ 0 │
│ 4.2.11 │ CRITICAL │ Ensure that the --rotate-certificates argument is not set to false │ PASS │ 0 │
│ 4.2.12 │ CRITICAL │ Verify that the RotateKubeletServerCertificate argument is set to true │ PASS │ 0 │
│ 4.2.13 │ CRITICAL │ Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers │ PASS │ 0 │
│ 5.1.1 │ HIGH │ Ensure that the cluster-admin role is only used where required │ FAIL │ 2 │
│ 5.1.2 │ HIGH │ Minimize access to secrets │ FAIL │ 16 │
│ 5.1.3 │ HIGH │ Minimize wildcard use in Roles and ClusterRoles │ FAIL │ 10 │
│ 5.1.6 │ HIGH │ Ensure that Service Account Tokens are only mounted where necessary │ PASS │ 0 │
│ 5.1.8 │ HIGH │ Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster │ PASS │ 0 │
│ 5.2.2 │ HIGH │ Minimize the admission of privileged containers │ PASS │ 0 │
│ 5.2.3 │ HIGH │ Minimize the admission of containers wishing to share the host process ID namespace │ PASS │ 0 │
│ 5.2.4 │ HIGH │ Minimize the admission of containers wishing to share the host IPC namespace │ PASS │ 0 │
│ 5.2.5 │ HIGH │ Minimize the admission of containers wishing to share the host network namespace │ PASS │ 0 │
│ 5.2.6 │ HIGH │ Minimize the admission of containers with allowPrivilegeEscalation │ FAIL │ 6 │
│ 5.2.7 │ MEDIUM │ Minimize the admission of root containers │ FAIL │ 6 │
│ 5.2.8 │ MEDIUM │ Minimize the admission of containers with the NET_RAW capability │ FAIL │ 3 │
│ 5.2.9 │ LOW │ Minimize the admission of containers with added capabilities │ PASS │ 0 │
│ 5.2.10 │ LOW │ Minimize the admission of containers with capabilities assigned │ FAIL │ 6 │
│ 5.2.11 │ MEDIUM │ Minimize the admission of containers with capabilities assigned │ PASS │ 0 │
│ 5.2.12 │ MEDIUM │ Minimize the admission of HostPath volumes │ PASS │ 0 │
│ 5.2.13 │ MEDIUM │ Minimize the admission of containers which use HostPorts │ FAIL │ 4 │
│ 5.3.1 │ MEDIUM │ Ensure that the CNI in use supports Network Policies (Manual) │ - │ - │
│ 5.3.2 │ MEDIUM │ Ensure that all Namespaces have Network Policies defined │ PASS │ 0 │
│ 5.4.1 │ MEDIUM │ Prefer using secrets as files over secrets as environment variables (Manual) │ - │ - │
│ 5.4.2 │ MEDIUM │ Consider external secret storage (Manual) │ - │ - │
│ 5.5.1 │ MEDIUM │ Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) │ - │ - │
│ 5.7.1 │ MEDIUM │ Create administrative boundaries between resources using namespaces (Manual) │ - │ - │
│ 5.7.2 │ MEDIUM │ Ensure that the seccomp profile is set to docker/default in your pod definitions │ PASS │ 0 │
│ 5.7.3 │ HIGH │ Apply Security Context to Your Pods and Containers │ FAIL │ 22 │
│ 5.7.4 │ MEDIUM │ The default namespace should not be used │ PASS │ 0 │
└────────┴──────────┴─────────────────────────────────────────────────────────────────────────────────────────────────────────────────┴────────┴────────┘
Pour obtenir toutes les informations détaillées il faut demander un rapport
complet avec l'option all.
trivy k8s cluster --compliance=k8s-cis --report all -s CRTITICAL
...
═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.
See https://avd.aquasec.com/misconfig/ksv020
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Deployment/metrics-server:183-228
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
183 ┌ - args:
184 │ - --cert-dir=/tmp
185 │ - --secure-port=10250
186 │ - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
187 │ - --kubelet-use-node-status-port
188 │ - --metric-resolution=15s
189 │ image: rancher/mirrored-metrics-server:v0.6.2
190 │ imagePullPolicy: IfNotPresent
191 └ livenessProbe:
...
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
...
Conclusion
On voit que l'audit des clusters kubernetes intégré à Trivy est très poussé. Même si elle est encore expérimentale, on peut déjà s'en servir pour renforcer la sécurité de nos clusters. En tout cas, on voit qu'utiliser une instance avec sa configuration par défaut offre de belles portes d'entrées. C'est tout un métier que de gérer des clusters kubernetes.