Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(k8s): filter kubernetes artifacts by REGO rules #8078

Open
afdesk opened this issue Dec 11, 2024 Discussed in #7980 · 0 comments
Open

feat(k8s): filter kubernetes artifacts by REGO rules #8078

afdesk opened this issue Dec 11, 2024 Discussed in #7980 · 0 comments
Labels
kind/feature Categorizes issue or PR as related to a new feature. target/kubernetes Issues relating to kubernetes cluster scanning

Comments

@afdesk
Copy link
Contributor

afdesk commented Dec 11, 2024

Now Trivy k8s scan can filter k8s artifacts only by namespaces and/or kinds (nodes,pods etc).

There is an idea to add a new filter option, that allows to filter artifacts by custom REGO rules.

for example, customers can use it for skipping scan on deployments with 0 desired replicas.

reporoduction steps

Deployment with 0 replicase (replicas0.yaml)

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-deploy
  labels:
    app: my-k8s-application
spec:
  selector:
    matchLabels:
      project: myproj0
  replicas: 0
  template:
    metadata:
      labels:
        project: myproj0
    spec:
      containers:
      - name: container-py
        image: alpine:3.14.1
        command: [ "/bin/sh", "-c", "--" ]
        args: [ "while true; do sleep 30; done;"]
$ kind delete cluster --name zeroreplicas && kind create cluster --name zeroreplicas
$ kubectl apply -f replicas0.yaml

Discussed in #7980

@afdesk afdesk added kind/feature Categorizes issue or PR as related to a new feature. target/kubernetes Issues relating to kubernetes cluster scanning labels Dec 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/feature Categorizes issue or PR as related to a new feature. target/kubernetes Issues relating to kubernetes cluster scanning
Projects
None yet
Development

No branches or pull requests

1 participant