3.3 KiB
docker run --rm -v "${PWD}:/work" aquasec/trivy:0.68.1 config /work/lab/lesson-27-fixture.yaml
AVD-KSV-0014 (HIGH): Container 'api' of Deployment 'checkout-api' should set 'securityContext.readOnlyRootFilesystem' to true ════════════════════════════════════════ ──────────────────────────────────────── lesson-27-fixture.yaml:21-28 ──────────────────────────────────────── 21 ┌ containers: 22 │ - name: api 23 │ image: nginx:latest 24 │ ports: 25 │ - containerPort: 8080 26 │ securityContext: 27 │ privileged: true 28 └ capabilities: ──────────────────────────────────────── explanation: rootFileSystem not readOnly so if the attacker gains access the the pod it can change the root directory remedy: enable readOnlyRootFilesystem in container security context
AVD-KSV-0017 (HIGH): Container 'api' of Deployment 'checkout-api' should set 'securityContext.privileged' to false ════════════════════════════════════════
──────────────────────────────────────── lesson-27-fixture.yaml:21-28 ──────────────────────────────────────── 21 ┌ containers: 22 │ - name: api 23 │ image: nginx:latest 24 │ ports: 25 │ - containerPort: 8080 26 │ securityContext: 27 │ privileged: true 28 └ capabilities: ────────────────────────────────────────
explanation: allow hacker to get privilege escalation inside the pod if the pod can get service token then it can hack the kubernetes system remedy: privileged: false
AVD-KSV-0118 (HIGH): deployment checkout-api in checkout namespace is using the default security context, which allows root privileges ════════════════════════════════════════
──────────────────────────────────────── lesson-27-fixture.yaml:19-28 ──────────────────────────────────────── 19 ┌ app: checkout-api 20 │ spec: 21 │ containers: 22 │ - name: api 23 │ image: nginx:latest 24 │ ports: 25 │ - containerPort: 8080 26 │ securityContext: 27 │ privileged: true 28 └ capabilities: ────────────────────────────────────────
explanation: allow hacker to get privilege escalation inside the pod if the pod can get service token then it can hack the kubernetes system remedy: runAsNonRoot: true