Skip to content

bug(k8s): RKE2 commands contain audits referencing incorrect paths #10167

@nikpivkin

Description

@nikpivkin

The audit definitions currently contain incorrect paths for Rancher. All commands in which the platform field contains only rke2 must be updated in the trivy-checks repository.

If a command specifies multiple platforms, for example:

platforms:
  - k8s
  - rke2

a separate command should be created specifically for rke2 in the same file (verify that trivy-kubernetes can load multiple commands from a single file). Then, remove rke2 from the original command’s platforms list and update compliance by adding the new command.

Example:

Before:

---
- id: CMD-0013
  key: adminConfFilePermissions
  title: admin.conf file permissions
  nodeType: master
  audit: stat -c %a /etc/kubernetes/admin.conf
  platforms:
    - k8s
    - rke2

After:

---
- id: CMD-0013
  key: adminConfFilePermissions
  title: admin.conf file permissions
  nodeType: master
  audit: stat -c %a /etc/kubernetes/admin.conf
  platforms:
    - k8s
---
- id: <newID>
  key: adminConfFilePermissions
  title: admin.conf file permissions
  nodeType: master
  audit: stat -c permissions=%a /var/lib/rancher/rke2/server/cred/admin.kubeconfig
  platforms:
    - rke2

Additionally, ensure that using the same key for multiple commands does not cause conflicts. If it does, create a new key (for example, by appending a -rke2 suffix).

The command can be generated using make command-id.

Discussed in #10162

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/bugCategorizes issue or PR as related to a bug.scan/misconfigurationIssues relating to misconfiguration scanningtarget/kubernetesIssues relating to kubernetes cluster scanning

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions