k8s: should trivy k8s --components=workload return rbac

[josedonizetti]

The new flag --compoents has two options, workload and infra. The infra option is for any k8s internal components. For anything else, the workload flag is used, but this can be mislead when scanning rbac.

trivy k8s all --namespace=kube-system  --report=summary --components=workload
34 / 34 [--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 2 p/s

Summary Report for minikube
┌─────────────┬──────────────────────────────────────┬─────────────────────┬────────────────────┬───────────────────┐
│  Namespace  │               Resource               │   Vulnerabilities   │ Misconfigurations  │      Secrets      │
│             │                                      ├───┬────┬───┬────┬───┼───┬───┬───┬────┬───┼───┬───┬───┬───┬───┤
│             │                                      │ C │ H  │ M │ L  │ U │ C │ H │ M │ L  │ U │ C │ H │ M │ L │ U │
├─────────────┼──────────────────────────────────────┼───┼────┼───┼────┼───┼───┼───┼───┼────┼───┼───┼───┼───┼───┼───┤
│ kube-system │ Pod/etcd-minikube                    │   │ 16 │ 4 │    │ 4 │   │ 1 │ 3 │ 7  │   │   │   │   │   │   │
│ kube-system │ Pod/kube-apiserver-minikube          │   │    │   │    │   │   │ 1 │ 3 │ 9  │   │   │   │   │   │   │
│ kube-system │ Pod/kube-scheduler-minikube          │   │    │   │    │   │   │ 1 │ 3 │ 8  │   │   │   │   │   │   │
│ kube-system │ Deployment/coredns                   │   │ 6  │ 2 │ 1  │ 5 │   │   │ 3 │ 5  │   │   │   │   │   │   │
│ kube-system │ DaemonSet/kube-proxy                 │ 7 │ 11 │ 3 │ 56 │   │   │ 2 │ 4 │ 10 │   │   │   │   │   │   │
│ kube-system │ Service/kube-dns                     │   │    │   │    │   │   │   │ 1 │    │   │   │   │   │   │   │
│ kube-system │ Pod/kube-controller-manager-minikube │   │    │   │    │   │   │ 1 │ 3 │ 8  │   │   │   │   │   │   │
│ kube-system │ Pod/storage-provisioner              │   │ 8  │ 2 │    │ 3 │   │ 1 │ 5 │ 10 │   │   │   │   │   │   │
└─────────────┴──────────────────────────────────────┴───┴────┴───┴────┴───┴───┴───┴───┴────┴───┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN


Summary Report for minikube
┌─────────────┬─────────────────────────────────────────────────────┬───────────────────┐
│  Namespace  │                      Resource                       │  RBAC Assessment  │
│             │                                                     ├───┬───┬───┬───┬───┤
│             │                                                     │ C │ H │ M │ L │ U │
├─────────────┼─────────────────────────────────────────────────────┼───┼───┼───┼───┼───┤
│ kube-system │ Role/system::leader-locking-kube-scheduler          │   │   │ 1 │   │   │
│ kube-system │ Role/system:controller:cloud-provider               │   │   │ 1 │   │   │
│ kube-system │ Role/system:controller:bootstrap-signer             │ 1 │   │   │   │   │
│ kube-system │ Role/system:persistent-volume-provisioner           │   │ 2 │   │   │   │
│ kube-system │ Role/system::leader-locking-kube-controller-manager │   │   │ 1 │   │   │
│ kube-system │ Role/system:controller:token-cleaner                │ 1 │   │   │   │   │
└─────────────┴─────────────────────────────────────────────────────┴───┴───┴───┴───┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN

See the discussion: #2589

[knqyf263]

For anything else, the workload flag is used, but this can be mislead when scanning rbac.

Is this because RBAC is not workload?

[josedonizetti]

For anything else, the workload flag is used, but this can be mislead when scanning rbac.

Is this because RBAC is not workload?

Yes, workloads are running components (pods, sts, deploy, etc). But at the same time, rbac is not the only thing, we have service, network plocies, etc that arent' workload. There is an issue to look into it, and maybe find a better name, as we discussed that the feature is marked as experimental