Project: Trivy-Operator (Provisioning / Security & Compliance)
File: clustercompliancedetail-report.md

The ClusterComplianceDetailReport is a cluster-scoped resource, which represents the latest result of the Cluster Compliance Detail report. The report data provides granular information on control check failures that occur in `ClusterComplianceReport`. This can be used for further investigation. The compliance detail report provides granular information on control check failures: Failing resource kind Name of the failing resource Namespace of the failing resource Failure error message Remediation The following listing shows a sample ClusterComplianceDetailReport for NSA specification associated with the `cluster` ```yaml apiVersion: aquasecurity.github.io/v1alpha1 kind: ClusterComplianceDetailReport metadata: creationTimestamp: '2022-03-27T07:04:21Z' generation: 6 name: nsa-details resourceVersion: '15788' uid: 9d36889d-086a-4fb3-b660-a3a3ecffe3c6 report: controlCheck: checkResults: details: msg: ReplicaSet 'coredns-96cc4f57d' should not be set with 'kube-system' namespace name: replicaset-coredns-96cc4f57d namespace: kube-system status: FAIL msg: ReplicaSet 'coredns-5789895cd' should not be set with 'kube-system' namespace name: replicaset-coredns-5789895cd namespace: kube-system status: FAIL msg: ReplicaSet 'traefik-56c4b88c4b' should not be set with 'kube-system' namespace name: replicaset-traefik-56c4b88c4b namespace: kube-system status: FAIL msg: ReplicaSet 'metrics-server-ff9dbcb6c' should not be set with 'kube-system' namespace name: replicaset-metrics-server-ff9dbcb6c namespace: kube-system status: FAIL msg: ReplicaSet 'local-path-provisioner-84bb864455' should not be set with 'kube-system' namespace name: replicaset-local-path-provisioner-84bb864455 namespace: kube-system status: FAIL id: KSV037 objectType: ReplicaSet details: msg: DaemonSet 'svclb-traefik' should not be set with 'kube-system' namespace name: daemonset-svclb-traefik namespace: kube-system status: FAIL id: KSV037 objectType: DaemonSet details: msg: Job 'helm-install-traefik-crd' should not be set with 'kube-system' namespace name: job-helm-install-traefik-crd namespace: kube-system status: FAIL msg: Job 'helm-install-traefik' should not be set with 'kube-system' namespace name: job-helm-install-traefik namespace: kube-system status: FAIL id: KSV037 objectType: Job description: Control check whether Namespace kube-system is not be used by users id: '1.12' name: Namespace kube-system should not be used by users severity: MEDIUM checkResults: details: msg: Resource do not exist in cluster status: FAIL objectType: ResourceQuota description: Control check the use of ResourceQuota policy to limit aggregate resource usage within namespace id: '4.0' name: Use ResourceQuota policies to limit resources severity: MEDIUM checkResults: details: msg: Container 'traefik' of ReplicaSet 'traefik-56c4b88c4b' should set 'securityContext.allowPrivilegeEscalation' to false name: replicaset-traefik-56c4b88c4b namespace: kube-system status: FAIL msg: Container 'local-path-provisioner' of ReplicaSet 'local-path-provisioner-84bb864455' should set 'securityContext.allowPrivilegeEscalation' to false name: replicaset-local-path-provisioner-84bb864455 namespace: kube-system status: FAIL id: KSV001 objectType: ReplicaSet details: msg: Container 'lb-port-443' of DaemonSet 'svclb-traefik' should set 'securityContext.allowPrivilegeEscalation' to false name: daemonset-svclb-traefik namespace: kube-system status: FAIL id: KSV001 objectType: DaemonSet details: msg: Container 'helm' of Job 'helm-install-traefik-crd' should set 'securityContext.allowPrivilegeEscalation' to false name: job-helm-install-traefik-crd namespace: kube-system status: FAIL msg: Container 'helm' of Job 'helm-install-traefik' should set 'securityContext.allowPrivilegeEscalation' to false name: job-helm-install-traefik namespace: kube-system status: FAIL id: KSV001 objectType: Job details: msg: Container 'nginx' of Pod 'nginx-jr99v' should set 'securityContext.allowPrivilegeEscalation' to false name: pod-nginx-jr99v namespace: trivy-operator-itest status: FAIL id: KSV001 objectType: Pod description: Control check restrictions escalation to root privileges id: '1.7' name: Restricts escalation to root privileges severity: MEDIUM checkResults: details: msg: Resource do not exist in cluster status: FAIL objectType: ResourceQuota description: Control check the use of LimitRange policy limit resource usage for namespaces or nodes id:

name: Use LimitRange policies to limit resources severity: MEDIUM checkResults: details: msg: Container 'local-path-provisioner' of ReplicaSet 'local-path-provisioner-84bb864455' should set 'securityContext.readOnlyRootFilesystem' to true name: replicaset-local-path-provisioner-84bb864455 namespace: kube-system status: FAIL id: KSV014 objectType: ReplicaSet details: msg: Container 'lb-port-443' of DaemonSet 'svclb-traefik' should set 'securityContext.readOnlyRootFilesystem' to true name: daemonset-svclb-traefik namespace: kube-system status: FAIL id: KSV014 objectType: DaemonSet details: msg: Container 'helm' of Job 'helm-install-traefik-crd' should set 'securityContext.readOnlyRootFilesystem' to true name: job-helm-install-traefik-crd namespace: kube-system status: FAIL msg: Container 'helm' of Job 'helm-install-traefik' should set 'securityContext.readOnlyRootFilesystem' to true name: job-helm-install-traefik namespace: kube-system status: FAIL id: KSV014 objectType: Job details: msg: Container 'nginx' of Pod 'nginx-jr99v' should set 'securityContext.readOnlyRootFilesystem' to true name: pod-nginx-jr99v namespace: trivy-operator-itest status: FAIL id: KSV014 objectType: Pod description: Check that container root file system is immutable id: '1.1' name: Immutable container file systems severity: LOW checkResults: details: msg: ReplicaSet 'traefik-56c4b88c4b' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0 name: replicaset-traefik-56c4b88c4b namespace: kube-system status: FAIL id: KSV029 objectType: ReplicaSet description: Controls whether container applications can run with root privileges or with root group membership id: '1.6' name: Run with root privileges or with root group membership severity: LOW checkResults: details: msg: Container of Pod 'nginx-jr99v' should set 'spec.automountServiceAccountToken' to false name: pod-nginx-jr99v namespace: trivy-operator-itest status: FAIL id: KSV036 objectType: Pod description: 'Control check whether disable secret token been mount ,automountServiceAccountToken: false' id: '1.11' name: Protecting Pod service account tokens severity: MEDIUM checkResults: details: msg: Resource do not exist in cluster status: FAIL objectType: NetworkPolicy description: Control check validate the pod and/or namespace Selectors usage id: '2.0' name: Pod and/or namespace Selectors usage severity: MEDIUM checkResults: details: msg: Container 'trivy-operator' of ReplicaSet 'trivy-operator-7cf866c47b' should set 'securityContext.runAsNonRoot' to true name: replicaset-trivy-operator-7cf866c47b namespace: trivy-system status: FAIL msg: Container 'coredns' of ReplicaSet 'coredns-96cc4f57d' should set 'securityContext.runAsNonRoot' to true name: replicaset-coredns-96cc4f57d namespace: kube-system status: FAIL msg: Container 'coredns' of ReplicaSet 'coredns-5789895cd' should set 'securityContext.runAsNonRoot' to true name: replicaset-coredns-5789895cd namespace: kube-system status: FAIL msg: Container 'trivy-operator' of ReplicaSet 'trivy-operator-c94dd56d' should set 'securityContext.runAsNonRoot' to true name: replicaset-trivy-operator-c94dd56d namespace: trivy-system status: FAIL msg: Container 'local-path-provisioner' of ReplicaSet 'local-path-provisioner-84bb864455' should set 'securityContext.runAsNonRoot' to true name: replicaset-local-path-provisioner-84bb864455 namespace: kube-system status: FAIL id: KSV012 objectType: ReplicaSet details: msg: Container 'lb-port-443' of DaemonSet 'svclb-traefik' should set 'securityContext.runAsNonRoot' to true name: daemonset-svclb-traefik namespace: kube-system status: FAIL id: KSV012 objectType: DaemonSet details: msg: Container 'helm' of Job 'helm-install-traefik-crd' should set 'securityContext.runAsNonRoot' to true name: job-helm-install-traefik-crd namespace: kube-system status: FAIL msg: Container 'helm' of Job 'helm-install-traefik' should set 'securityContext.runAsNonRoot' to true name: job-helm-install-traefik namespace: kube-system status: FAIL id: KSV012 objectType: Job details: msg: Container 'nginx' of Pod 'nginx-jr99v' should set 'securityContext.runAsNonRoot' to true name: pod-nginx-jr99v namespace: trivy-operator-itest status: FAIL id: KSV012 objectType: Pod description: Check that container is not running as root id: '1.0' name: Non-root containers severity: MEDIUM summary: failCount: 33 passCount: 113 type: description: national security agency - kubernetes hardening guidance name: nsa-details version: '1.0' updateTimestamp: '2022-03-27T07:09:00Z' ```