skip-tls-verify-cluster.yaml

rules:
- id: skip-tls-verify-cluster
  pattern: |
    cluster:
      ...
      insecure-skip-tls-verify: true
  message: >-
    Cluster is disabling TLS certificate verification when communicating with
    the server. This makes your HTTPS connections insecure. Remove the
    'insecure-skip-tls-verify: true' key to secure communication.
  metadata:
    cwe:
    - 'CWE-319: Cleartext Transmission of Sensitive Information'
    references:
    - https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster
    category: security
    technology:
    - kubernetes
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
  languages: [yaml]
  severity: WARNING