Add --all-namespaces flag for trivy k8s resources scanning

[nilesh-akhade]

When we do resource scanning, trivy scans it in only the given namespace. This should be improved by adding --all-namespaces aka -A flag.

Use cases

• Scan only config maps from all namespaces
• Scan everything from the cluster except cronjobs and jobs Possibility to Exclude Jobs/cronjobs from scanning trivy-operator#265
  Skipping cronjobs, and jobs are particularly useful when the cluster has hundreds non-running jobs; all created from the same spec.

Examples:

  # namespace scanning:
  $ trivy k8s -n kube-system --report summary all

  # resources scanning:
  $ trivy k8s --report=summary deploy
  $ trivy k8s --namespace=kube-system --report=summary deploy,configmaps
  $ trivy k8s --all-namespaces --report=summary configmaps
  $ trivy k8s -A --report=summary deployments,replicasets,replicationcontrollers,statefulsets,daemonsets,services,pods,configmaps,roles,rolebindings,networkpolicies,ingresses,resourcequotas,limitranges,clusterroles,clusterrolebindings,podsecuritypolicies

[knqyf263]

@chen-keinan What do you think?

[chen-keinan]

@chen-keinan What do you think?

sound reasonable

[thapabishwa]

When I run configmap with--all-namespaces, it fails to report all items

trivy k8s --all-namespaces --report=summary configmaps

Summary Report for arn:aws:eks:<region>:<account>:cluster/eks-cluster


Workload Assessment
┌───────────┬────────────────────────────┬───────────────────┬───────────────────┬───────────────────┐
│ Namespace │          Resource          │  Vulnerabilities  │ Misconfigurations │      Secrets      │
│           │                            ├───┬───┬───┬───┬───┼───┬───┬───┬───┬───┼───┬───┬───┬───┬───┤
│           │                            │ C │ H │ M │ L │ U │ C │ H │ M │ L │ U │ C │ H │ M │ L │ U │
├───────────┼────────────────────────────┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┼───┤
│ default   │ ConfigMap/kube-root-ca.crt │   │   │   │   │   │   │   │   │ 1 │   │   │   │   │   │   │
└───────────┴────────────────────────────┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN

Trivy Version

trivy --version                                       
Version: 0.44.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-08-25 06:08:52.74908423 +0000 UTC
  NextUpdate: 2023-08-25 12:08:52.74908373 +0000 UTC
  DownloadedAt: 2023-08-25 08:24:37.498688 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2023-08-23 00:59:25.619115427 +0000 UTC
  NextUpdate: 2023-08-26 00:59:25.619114827 +0000 UTC
  DownloadedAt: 2023-08-23 03:12:22.137159 +0000 UTC
Policy Bundle:
  Digest: sha256:2e95a2d5d45de8ebecae53a97403230a6c608a579b082f3de170f3cf09e46243
  DownloadedAt: 2023-08-25 04:42:45.175519 +0000 UTC

Cm Lists

 kubectl get cm -A                                                                                    
NAMESPACE         NAME                                                   DATA   AGE
cert-manager      cert-manager-webhook                                   0      9d
cert-manager      kube-root-ca.crt                                       1      9d
default           kube-root-ca.crt                                       1      16d
kube-node-lease   kube-root-ca.crt                                       1      16d
kube-public       kube-root-ca.crt                                       1      16d
kube-system       aws-auth                                               3      16d
kube-system       aws-for-fluent-bit                                     1      14d
kube-system       coredns                                                1      16d
kube-system       extension-apiserver-authentication                     6      16d
kube-system       kube-apiserver-legacy-service-account-token-tracking   1      16d
kube-system       kube-proxy                                             1      16d
kube-system       kube-proxy-config                                      1      16d
kube-system       kube-root-ca.crt                                       1      16d
workload          kube-root-ca.crt                                       1      11d
workload          workload-policies                                      1      11d