[config] Add readinessProbe/livenessProbe checks to Kubernetes/Helm

[atombrella]

Description

I couldn't find this listed in https://www.stigviewer.com/stig/kubernetes/

Kubernetes' official documentation:
https://kubernetes.io/docs/concepts/configuration/liveness-readiness-startup-probes/

If you create a basic chart with helm create sample and then remove the livenessProbe, readinessProbe (and startupProbe), Trivy doesn't come with these suggestions.

It's related to reliability, and not security. The only Kubernetes linter that I know of which checks for this is
kube-score

Version: 0.58.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-10-05 12:15:24.045381837 +0000 UTC
  NextUpdate: 2024-10-06 12:15:24.045381707 +0000 UTC
  DownloadedAt: 2024-10-05 16:24:18.819563279 +0000 UTC
Check Bundle:
  Digest: sha256:ef2d9ad4fce0f933b20a662004d7e55bf200987c180e7f2cd531af631f408bb3
  DownloadedAt: 2024-12-23 11:47:10.385921794 +0000 UTC

If possible, you can leave some hints in this issue how to implement this. I guess defsec would be a good place to start.

Target

Kubernetes

Scanner

Misconfiguration

[nikpivkin]

Hi @atombrella !

This is not security related and may create noise for users. You can write a custom check that will check for the presence of readinessProbe/livenessProbe.

[atombrella]

OK. I'll try to write those 2/3 checks :) Maybe as a compromise, they could be added inside a contrib-folder, so they won't be part of the official bundle?

[nikpivkin]

/cc @itaysk

[nikpivkin]

what do you mean by 2/3 checks?

[itaysk]

Hi there, we are not going to add a contrib directory with non-security checks, since it might still create expectations that we maintain those checks. alternatively, feel free to create another repo for complementary trivy checks that you/the community can maintain. if you want to make it more discoverable, you can add it to the ecosystem section in the trivy documentation.