Ignoring misconfigurations for specific K8s resources

[fgreinacher]

Question

Let's assume I have two misconfigurations AVD-KSV-0108 for the Kubernetes services foo and bar in the namespace baz.

I can create a .trivyignore.yaml like this to ignore both misconfigurations:

misconfigurations:
  - id: AVD-KSV-0118

But often I don't want to ignore all misconfigurations, but rather select the resource(s) for which a misconfiguration is ignored, similar to paths for other targets:

misconfigurations:
  - id: AVD-KSV-0118
    resources:  # Does not exist
       - baz/service/foo

Is this currently possible?

Target

Kubernetes

Scanner

Misconfiguration

Output Format

None

Mode

Standalone

Operating System

No response

Version

No response

[simar7]

hi @fgreinacher - it's not possible to do that with the trivy config file but you could write a custom check to accomplish this.

[fgreinacher]

Thanks @simar7, I really don't want to write a custom check, but rather ignore/acknwoledge results of existing checks.

I tried to ignore misconfigurations via a Rego ignore policy, but those don't really provide a lot of context as far as I can see.

The best I could come up with is to ignore based on messages like this:

package trivy

import future.keywords.in

default ignore = false

ignore {
    input.Message in [
        "Container 'postgres-exporter' of StatefulSet 'abc-db' should set 'securityContext.readOnlyRootFilesystem' to true",
        "Container 'postgres' of StatefulSet 'abc-db' should set 'securityContext.readOnlyRootFilesystem' to true",
        "container abc-db in abc namespace is using the default security context",
        "container abc in def namespace is using the default security context",
        "Container 'abc' of Deployment 'abc' should set 'securityContext.readOnlyRootFilesystem' to true",
        "Container 'nginx' of Deployment 'abc' should set 'securityContext.readOnlyRootFilesystem' to true",
        "ConfigMap 'abc-db-config-ghcg6ffd5t' in 'abc' namespace stores secrets in key(s) or value(s) '{\"POSTGRES_PASSWORD\"}'"
    ]
}

But it feels really hacky :)

[simar7]

Yes you're on the right path - it could look like the following:

package trivy

import rego.v1

exempt_resources := {
    "foo"
}

default ignore := false

ignore if not is_resource_exempt

is_resource_exempt if input.CauseMetadata in exempt_resources

You can find some more Rego examples here https://github.com/aquasecurity/trivy/tree/main/examples/ignore-policies

[fgreinacher]

Thanks again @simar7, this is helpful. Unfortunately CauseMetadata does not contain a reference to the resource names (my command line looks roughly like this: trivy k8s --include-namespaces foo-namespace --skip-images --severity HIGH,CRITICAL --report all --format json )

{
  "CauseMetadata": {
    "Provider": "Kubernetes",
    "Service": "general",
    "Code": {
      "Lines": null
    }
  }
}

I assume this would need to be improved in the k8s target/provider, correct? If so, could you point me to the relevant source code? I'd be happy to contribute something there if it helps.

[simar7]

Can you share a small example that produces this output? Not having a cause usually implies not having a reference to begin with.

[fgreinacher]

@simar7 I'm running the command above against one of our clusters. Which information would help you understand the issue better?