feat: config outdated-api result filtered by k8s version

[chen-keinan]

Signed-off-by: chenk hen.keinan@gmail.com

Description

Related issues

• Close K8s depreciation evaluation should take under consideration the k8s version #3338

PRs

• feat: add support for virtual files in mapfs #3654
• feat(rego): accept fs.FS for data defsec#1191

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.

Usage affected k8s version example:

trivy config ~/data/input.json --skip-policy-update  --k8s-version=1.22.0
2023-02-08T18:00:49.111+0200  INFO  Misconfiguration scanning is enabled
2023-02-08T18:00:49.111+0200  INFO  No downloadable policies were loaded as --skip-policy-update is enabled
2023-02-08T18:00:49.725+0200  INFO  Detected config files: 1

input.json (kubernetes)

Tests: 145 (SUCCESSES: 144, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

LOW: apiVersion 'batch/v1beta1' and kind ‘CronJob' should be replaced with the new API 'batch.v1.CronJob'
See https://github.com/kubernetes/kubernetes/tree/master/staging/src/k8s.io/api/batch/v1beta1/zz_generated.prerelease-lifecycle.go
════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
apiVersion 'batch/v1beta1' and kind 'CronJob' has been deprecated on: 'v1.21' and planned for removal on:'v1.25'

See https://github.com/kubernetes/kubernetes/tree/master/staging/src/k8s.io/api/batch/v1beta1/zz_generated.prerelease-lifecycle.go
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 input.json:1-5
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1 ┌ {
   2 │     "apiVersion": "batch/v1beta1",
   3 │     "kind": "CronJob",
   4 │     "metadata": {
   5 └         "name": "pi"
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Example of non affected k8s version:

trivy config ~/data/input.json --skip-policy-update  --k8s-version=1.20.0
2023-02-08T18:00:42.276+0200	INFO	Misconfiguration scanning is enabled
2023-02-08T18:00:42.276+0200	INFO	No downloadable policies were loaded as --skip-policy-update is enabled
2023-02-08T18:00:42.891+0200	INFO	Detected config files: 1
☁  trivy [k8sver] ⚡  ./main config ~/data/input.json --skip-policy-update  --k8s-version=1.21.0
2023-02-08T18:00:46.008+0200	INFO	Misconfiguration scanning is enabled
2023-02-08T18:00:46.008+0200	INFO	No downloadable policies were loaded as --skip-policy-update is enabled
2023-02-08T18:00:46.624+0200	INFO	Detected config files: 1

input.json (kubernetes)

Tests: 145 (SUCCESSES: 144, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

where: ~/data/input.json

{
    "apiVersion": "batch/v1beta1",
    "kind": "CronJob",
    "metadata": {
        "name": "pi"
    },
    "spec": {
        "template": {
            "spec": {
                "containers": [
                    {
                        "name": "pi",
                        "image": "perl:5.34.0",
                        "command": [
                            "perl",
                            "-Mbignum=bpi",
                            "-wle",
                            "print bpi(2000)"
                        ]
                    }
                ],
                "restartPolicy": "Never"
            }
        },
        "backoffLimit": 4
    }
}

[chen-keinan]

Depend on DefSec PR and DefSec Tag > v0.82.9

[knqyf263]

Depend on aquasecurity/defsec#1165 and DefSec Tag > v0.82.9

Is it ready now?

[itaysk]

Great!
very small nit, this is a feat not a fix (commit message)

[chen-keinan]

Great! very small nit, this is a feat not a fix (commit message)

fixed.

[chen-keinan]

Depend on aquasecurity/defsec#1165 and DefSec Tag > v0.82.9

Is it ready now?

@knqyf263 yes its ready , we just need to make sure a new defsec package is distributed before trivy v0.38.0. released (so trivy could download the updated policy), shouldn't hold this PR

[chen-keinan]

@knqyf263 comments has been addressed

[chen-keinan]

@knqyf263 pr is updated with latest defsec and tested it locally , looks good.

[knqyf263]

Nice! I've added one more commit.