feat(k8s): add support for vulnerability detection #5268

knqyf263 · 2023-09-28T19:55:51Z

Description

Add support for vulnerability detection.

Example

$ trivy k8s --format cyclonedx cluster -o kbom.json
$ trivy sbom kbom.json
2023-09-28T22:52:25.707+0300    INFO    Vulnerability scanning is enabled
2023-09-28T22:52:25.707+0300    INFO    Detected SBOM format: cyclonedx-json
2023-09-28T22:52:25.717+0300    WARN    No OS package is detected. Make sure you haven't deleted any files that contain information about the installed packages.
2023-09-28T22:52:25.717+0300    WARN    e.g. files under "/lib/apk/db/", "/var/lib/dpkg/" and "/var/lib/rpm"
2023-09-28T22:52:25.717+0300    INFO    Detected OS: debian gnu/linux
2023-09-28T22:52:25.717+0300    WARN    unsupported os : debian gnu/linux
2023-09-28T22:52:25.717+0300    INFO    Number of language-specific files: 3
2023-09-28T22:52:25.717+0300    INFO    Detecting kubernetes vulnerabilities...
2023-09-28T22:52:25.718+0300    INFO    Detecting gobinary vulnerabilities...

Kubernetes (kubernetes)

Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

┌────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────────────────┬──────────────────────────────────────────────────┐
│    Library     │ Vulnerability  │ Severity │ Status │ Installed Version │          Fixed Version          │                      Title                       │
├────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────────────────┼──────────────────────────────────────────────────┤
│ k8s.io/kubelet │ CVE-2021-25749 │ HIGH     │ fixed  │ 1.24.0            │ 1.22.14, 1.23.11, 1.24.5        │ runAsNonRoot logic bypass for Windows containers │
│                │                │          │        │                   │                                 │ https://avd.aquasec.com/nvd/cve-2021-25749       │
│                ├────────────────┼──────────┤        │                   ├─────────────────────────────────┼──────────────────────────────────────────────────┤
│                │ CVE-2023-2431  │ LOW      │        │                   │ 1.24.14, 1.25.9, 1.26.4, 1.27.1 │ Bypass of seccomp profile enforcement            │
│                │                │          │        │                   │                                 │ https://avd.aquasec.com/nvd/cve-2023-2431        │
└────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────────┴──────────────────────────────────────────────────┘

TODO

Related issues

Close kbom component matching with k8s vulndb #5020

Related PRs

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

Signed-off-by: knqyf263 <knqyf263@gmail.com>

knqyf263 · 2023-09-28T19:57:11Z

go.mod

@@ -403,3 +403,5 @@ require (
 // oras 1.2.2 is incompatible with github.com/docker/docker v24.0.2
 // cf. https://github.com/oras-project/oras-go/pull/527
 replace oras.land/oras-go => oras.land/oras-go v1.2.4-0.20230801060855-932dd06d38af
+
+replace github.com/aquasecurity/trivy-db => github.com/chen-keinan/trivy-db v0.0.0-20230927090622-d1e5b3f57a57


TODO: refer to aquasecurity/trivy-db

Signed-off-by: knqyf263 <knqyf263@gmail.com>

DmitriyLewen · 2023-09-29T08:07:10Z

pkg/fanal/analyzer/sbom/testdata/kbom.json

+    {
+      "bom-ref": "5262e708-f1a3-4fca-a1c3-0a8384f7f4a5",
+      "type": "operating-system",
+      "name": "ubuntu",


I created this KBOM file using Trivy.
Why don't we include OS packages like in table format?

➜ trivy -d k8s cluster --report all ... registry.k8s.io/kube-proxy:v1.27.4 (debian 11.6) ================================================ Total: 36 (UNKNOWN: 0, LOW: 22, MEDIUM: 12, HIGH: 2, CRITICAL: 0)

chen-keinan · 2023-10-03T11:25:44Z

pkg/k8s/scanner/scanner.go

@@ -254,6 +256,7 @@ func clusterInfoToReportResources(allArtifact []*artifacts.Artifact) (*core.Comp
 				Type:       cdx.ComponentTypeApplication,
 				Properties: toProperties(comp.Properties, k8sCoreComponentNamespace),
 				Components: imageComponents,
+				PackageURL: generatePURL(comp.Name, comp.Version),


we might need to have special handling for pre-release versions (I mean skip these versions) example:
v1.25.4-hotfix.20221216 or or 1.24.10-gke.2300

we might need to have special handling for pre-release versions (I mean skip these versions) example:

Could you elaborate on why we need to skip pre-release versions? If trivy k8s finds the version in the cluster, it means the pre-release version is used in production, doesn't it?

chen-keinan · 2023-10-03T11:26:25Z

pkg/k8s/scanner/scanner.go

@@ -386,7 +390,7 @@ func nodeComponent(nf bom.NodeInfo) *core.Component {
 							},
 						},
 						PackageURL: &purl.PackageURL{
-							PackageURL: *packageurl.NewPackageURL(golang, "", kubelet, kubeletVersion, packageurl.Qualifiers{}, ""),
+							PackageURL: *packageurl.NewPackageURL(purl.TypeK8s, "k8s.io", "kubelet", kubeletVersion, packageurl.Qualifiers{}, ""),


Signed-off-by: chenk <hen.keinan@gmail.com>

Signed-off-by: knqyf263 <knqyf263@gmail.com>

docs/docs/target/kubernetes.md

docs/docs/scanner/vulnerability.md

chen-keinan · 2023-10-06T08:22:38Z

pkg/purl/purl.go

+		if p.Namespace == "" {
+			return ftypes.K8sComponent
+		}
+		// Cloud k8s distributions, such as EKS, are not supported yet.
+		return TypeUnknown


can you please explain this part ? don't we want to add support for cloud providers in code and just add advisory data later (so we do not need to change code) ?

I was unsure how we wanted to match cloud distributions for vulnerabilities. I've added the current idea. Please let me know if you have any feedback.
24f2a8b

DmitriyLewen · 2023-10-13T08:10:18Z

pkg/purl/purl.go

+		case NamespaceOCP:
+			return ftypes.OCP
+		case "":
+			return ftypes.Kubernetes


ftypes.Kubernetes is ConfigType. Or am i missing something?

Suggested change

return ftypes.Kubernetes

return ftypes.K8sUpstream

You're right.

DmitriyLewen · 2023-10-13T08:13:25Z

pkg/k8s/scanner/scanner.go

@@ -208,6 +208,17 @@ const (
 func clusterInfoToReportResources(allArtifact []*artifacts.Artifact) (*core.Component, error) {
 	var coreComponents []*core.Component
 	var cInfo *core.Component
+
+	// Find the fist node name to identify AKS cluster


Suggested change

// Find the fist node name to identify AKS cluster

// Find the first node name to identify AKS cluster

DmitriyLewen

LGTM

chen-keinan · 2023-10-13T12:33:16Z

pkg/k8s/scanner/scanner.go

+		namespace = purl.NamespaceOCP
+	}
+	return &purl.PackageURL{
+		PackageURL: *packageurl.NewPackageURL(purl.TypeK8s, namespace, name, ver, nil, ""),


nit: note sure if for now , it will be better to use option pattern to avoid passing nil and empty strings

chen-keinan · 2023-10-13T12:41:34Z

pkg/purl/purl.go

+		case "":
+			return ftypes.K8sUpstream
+		}
+		return TypeUnknown


nit:

Suggested change

case "":

return ftypes.K8sUpstream

}

return TypeUnknown

case "":

return ftypes.K8sUpstream

default:

return TypeUnknown

}

knqyf263 added 2 commits September 28, 2023 22:06

chore(deps): bump trivy-kubernetes

a92a5c4

Signed-off-by: knqyf263 <knqyf263@gmail.com>

chore(deps): replace trivy-db

3bf3125

Signed-off-by: knqyf263 <knqyf263@gmail.com>

knqyf263 self-assigned this Sep 28, 2023

knqyf263 commented Sep 28, 2023

View reviewed changes

knqyf263 added 3 commits September 28, 2023 23:00

fix(purl): skip empty qualifiers

2f0646f

Signed-off-by: knqyf263 <knqyf263@gmail.com>

refactor(purl): add Class()

8d6275c

Signed-off-by: knqyf263 <knqyf263@gmail.com>

feat(k8s) add support for vulnerability detection

5e309e6

Signed-off-by: knqyf263 <knqyf263@gmail.com>

knqyf263 force-pushed the k8s_purl branch from 2eacf33 to 5e309e6 Compare September 28, 2023 20:00

test(k8s): fix PURL for kubelet

7bbd0d0

Signed-off-by: knqyf263 <knqyf263@gmail.com>

DmitriyLewen mentioned this pull request Sep 29, 2023

feat(k8s): add k8s vulns in table format #5275

Closed

8 tasks

add sbom analyzer test and integration test

8a4430d

DmitriyLewen reviewed Sep 29, 2023

View reviewed changes

DmitriyLewen added 3 commits September 29, 2023 14:13

fix typo

d2cf197

update KBOM golden file

b49fe17

move test to cyclonedx unmarshal

88160f5

chen-keinan reviewed Oct 3, 2023

View reviewed changes

chen-keinan and others added 13 commits October 4, 2023 10:53

feat: support other k8s vendor purl

0765482

Signed-off-by: chenk <hen.keinan@gmail.com>

Merge branch 'main' into k8s_purl

96a64a4

Merge branch 'main' into k8s_purl

0ef7fba

Merge branch 'main' into k8s_purl

d6bd096

test: multi k8s provider purl

9defd4a

Signed-off-by: chenk <hen.keinan@gmail.com>

test: multi k8s provider purl

a640837

Signed-off-by: chenk <hen.keinan@gmail.com>

chore: refer upstream

af27321

Signed-off-by: knqyf263 <knqyf263@gmail.com>

docs: add a spec for the k8s type

5c9d2d0

Signed-off-by: knqyf263 <knqyf263@gmail.com>

fix: revert a regression

a0d815d

Signed-off-by: knqyf263 <knqyf263@gmail.com>

refactor: use strings.Cut

a960978

Signed-off-by: knqyf263 <knqyf263@gmail.com>

fix: skip cloud k8s distributions

0ef60ec

Signed-off-by: knqyf263 <knqyf263@gmail.com>

test: fix PURLs

46347bb

Signed-off-by: knqyf263 <knqyf263@gmail.com>

chore: downgrade to go 1.20

9c35374

Signed-off-by: knqyf263 <knqyf263@gmail.com>

knqyf263 force-pushed the k8s_purl branch from 44c5949 to 9c35374 Compare October 5, 2023 17:41

test(integration): fix k8s PURLs

07365c6

Signed-off-by: knqyf263 <knqyf263@gmail.com>

knqyf263 marked this pull request as ready for review October 5, 2023 20:26

knqyf263 requested a review from josedonizetti as a code owner October 5, 2023 20:26

DmitriyLewen added 2 commits October 6, 2023 11:11

docs: add info about scan k8s components

e06442d

docs: move usage info to kubernetes target

241002c

chen-keinan reviewed Oct 6, 2023

View reviewed changes

docs: specify Kubernetes components

7c98227

itaysk mentioned this pull request Oct 11, 2023

docs: add kbom documentation #5363

Merged

6 tasks

knqyf263 added 3 commits October 13, 2023 16:28

feat: add cloud k8s distributions

24f2a8b

Merge branch 'main' into k8s_purl

fe161ce

fix: add nolint

25bc6c6

DmitriyLewen reviewed Oct 13, 2023

View reviewed changes

knqyf263 added 2 commits October 13, 2023 17:17

docs: typo

10a3dde

fix: use the correct const

37688b0

DmitriyLewen approved these changes Oct 13, 2023

View reviewed changes

chen-keinan reviewed Oct 13, 2023

View reviewed changes

Merge branch 'main' into k8s_purl

2b2153b

knqyf263 added this pull request to the merge queue Oct 14, 2023

Merged via the queue into aquasecurity:main with commit cbbd1ce Oct 14, 2023
18 checks passed

knqyf263 deleted the k8s_purl branch October 14, 2023 13:04

chen-keinan mentioned this pull request Nov 7, 2023

Scanning for k8s vulnerabilities aquasecurity/trivy-operator#1621

Closed

aqua-bot mentioned this pull request May 29, 2024

release: v0.52.0 [main] #6809

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(k8s): add support for vulnerability detection #5268

feat(k8s): add support for vulnerability detection #5268

knqyf263 commented Sep 28, 2023 •

edited

knqyf263 Sep 28, 2023

DmitriyLewen Sep 29, 2023

chen-keinan Oct 3, 2023 •

edited

knqyf263 Oct 3, 2023

chen-keinan Oct 3, 2023

chen-keinan Oct 6, 2023

knqyf263 Oct 13, 2023

DmitriyLewen Oct 13, 2023

knqyf263 Oct 13, 2023 •

edited

DmitriyLewen Oct 13, 2023

DmitriyLewen left a comment

chen-keinan Oct 13, 2023

chen-keinan Oct 13, 2023

	// Find the fist node name to identify AKS cluster
	// Find the first node name to identify AKS cluster

feat(k8s): add support for vulnerability detection #5268

feat(k8s): add support for vulnerability detection #5268

Conversation

knqyf263 commented Sep 28, 2023 • edited

Description

Example

TODO

Related issues

Related PRs

Checklist

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chen-keinan Oct 3, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

knqyf263 Oct 13, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DmitriyLewen left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

knqyf263 commented Sep 28, 2023 •

edited

chen-keinan Oct 3, 2023 •

edited

knqyf263 Oct 13, 2023 •

edited