fix(security): scope trivy KSV-0037 to the infrastructure trees - #3054
Merged
Conversation
All 47 KSV-0037 findings are cluster components that belong in kube-system by construction — CNI, DNS, CSI, cloud-controller-manager, and their namespace-local VerticalPodAutoscalers, PodDisruptionBudgets, Gateway and Certificate material. A VPA targetRef and a PDB selector are namespace-local, so those cannot live anywhere else; the one Deployment is CoreDNS. Scoped to the infrastructure trees rather than skipped, so the check stays live for application trees. Verified with a paired control: the same manifest FAILs under k8s/bases/apps/ and is excepted under k8s/bases/infrastructure/. trivy 157 -> 110 across 27 targets. The earlier recorded 163 was v0.72.0; 157 is v0.73.0 on the same manifests, so that difference is scanner rule-set drift, not backlog movement. Part of #2787
3 tasks
Self-review found the claim that the tenant trees stay covered was wrong: there is no separate tenant tree, and the KRO ResourceGraphDefinitions that generate tenants sit inside the scoped path. Measured the actual reach instead — trivy reports zero misconfigurations on both RGD files with or without this entry, because it does not descend into the templates nested in an RGD, so tenant workloads are outside this check either way. Filed as #3055 and stated here rather than implied.
Contributor
✅
|
Contributor
Author
What I verified locally, and the one thing only CI can settleVerified locally (trivy v0.73.0, the exact CI invocation
The open question this PR's own That is checkable rather than arguable, and it is checked by the job on this PR: MegaLinter's trivy run |
Contributor
Author
CI answered the glob question — it carries to trivy v0.71.2Read from this PR's own
The two independently agree on the exact total, so the The zero is attributable, because its neighbours are not zero. Every other check from the One pre-existing defect noticed in the same log, NOT fixed here
It is mode |
Contributor
Author
Requesting a review at @coderabbitai review |
Contributor
|
✅ Action performedReview finished.
|
Contributor
📝 WalkthroughWalkthroughThe change adds a path-scoped KSV-0037 exception for Kubernetes infrastructure manifests that run in Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
Readiness at
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The security scanners on
k8s/still report on every pull request without failing the build, whilea backlog is worked off. The largest remaining group was one check firing 47 times — 30% of trivy's
findings on the tree — on cluster components that are exactly where they should be.
Left as noise, it buries the findings that matter. The residual on this tree still includes
HIGH/CRITICAL RBAC breadth, and that is much harder to see behind 47 reports about CoreDNS and the
CNI living in
kube-system.What
Scopes that one check to the infrastructure trees, with the reasoning recorded next to it, and
corrects the recorded scanner figures the config asks each slice to re-measure.
The check itself protects something real — an application does not belong in
kube-system— so itis scoped, not switched off. It stays live for application trees, and a user workload placed in
kube-systemis still reported. That boundary was verified rather than assumed, with two copies ofone manifest: the copy under the apps tree fails the check, the copy under the infrastructure tree
is excepted. Same bytes, different path.
Measured with the repository's own counts script: trivy 157 → 110 across 27 targets. checkov is
unchanged at 9.
Two honesty notes, both carried into the config rather than left in this description:
version on unchanged manifests, so those 6 are scanner rule-set drift rather than progress. Only
the 47 are this change's work.
not covered, and not because of this change: tenants are generated from
ResourceGraphDefinitiontemplates that no static scanner descends into, measured at zero findings with and without this
entry. Filed separately as Workload templates inside ResourceGraphDefinitions are invisible to every static scanner #3055 and stated plainly in the comment instead of implied.
Part of #2787