61 lines
3.3 KiB
Markdown
61 lines
3.3 KiB
Markdown
docker run --rm -v "${PWD}:/work" aquasec/trivy:0.68.1 config /work/lab/lesson-27-fixture.yaml
|
|
|
|
|
|
|
|
AVD-KSV-0014 (HIGH): Container 'api' of Deployment 'checkout-api' should set 'securityContext.readOnlyRootFilesystem' to true
|
|
════════════════════════════════════════
|
|
────────────────────────────────────────
|
|
lesson-27-fixture.yaml:21-28
|
|
────────────────────────────────────────
|
|
21 ┌ containers:
|
|
22 │ - name: api
|
|
23 │ image: nginx:latest
|
|
24 │ ports:
|
|
25 │ - containerPort: 8080
|
|
26 │ securityContext:
|
|
27 │ privileged: true
|
|
28 └ capabilities:
|
|
────────────────────────────────────────
|
|
explanation: rootFileSystem not readOnly so if the attacker gains access the the pod it can change the root directory
|
|
remedy: enable readOnlyRootFilesystem in container security context
|
|
|
|
|
|
AVD-KSV-0017 (HIGH): Container 'api' of Deployment 'checkout-api' should set 'securityContext.privileged' to false
|
|
════════════════════════════════════════
|
|
|
|
────────────────────────────────────────
|
|
lesson-27-fixture.yaml:21-28
|
|
────────────────────────────────────────
|
|
21 ┌ containers:
|
|
22 │ - name: api
|
|
23 │ image: nginx:latest
|
|
24 │ ports:
|
|
25 │ - containerPort: 8080
|
|
26 │ securityContext:
|
|
27 │ privileged: true
|
|
28 └ capabilities:
|
|
────────────────────────────────────────
|
|
|
|
explanation: allow hacker to get privilege escalation inside the pod if the pod can get service token then it can hack the kubernetes system
|
|
remedy: privileged: false
|
|
|
|
AVD-KSV-0118 (HIGH): deployment checkout-api in checkout namespace is using the default security context, which allows root privileges
|
|
════════════════════════════════════════
|
|
|
|
────────────────────────────────────────
|
|
lesson-27-fixture.yaml:19-28
|
|
────────────────────────────────────────
|
|
19 ┌ app: checkout-api
|
|
20 │ spec:
|
|
21 │ containers:
|
|
22 │ - name: api
|
|
23 │ image: nginx:latest
|
|
24 │ ports:
|
|
25 │ - containerPort: 8080
|
|
26 │ securityContext:
|
|
27 │ privileged: true
|
|
28 └ capabilities:
|
|
────────────────────────────────────────
|
|
|
|
explanation: allow hacker to get privilege escalation inside the pod if the pod can get service token then it can hack the kubernetes system
|
|
remedy: runAsNonRoot: true |