You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the issue
I've been writing some Custom Policies, and I've tried both yaml and Python. These are scanning Terraform AKS clusters, there's not a huge amount of code being scanned. However the built-in scans are showing up in the results, not the custom ones.
Examples
Here's an example of one of them: -
int.py
from .kubernetes_no_privilege_escalation_check import KubernetesNoPrivilegeEscalationCheck
`from checkov.common.models.enums import CheckCategories, CheckResult
from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck
class KubernetesNoPrivilegeEscalationCheck(BaseK8sContainerCheck):
def init(self):
name = "Ensure Kubernetes containers do not allow privilege escalation"
id = "CUSTOM_K8S_6"
supported_resources = [
"kubernetes_pod",
"kubernetes_deployment",
"kubernetes_stateful_set",
"kubernetes_daemonset",
"kubernetes_replica_set"
]
categories = [CheckCategories.KUBERNETES]
super().init(name=name, id=id, categories=categories, supported_entities=supported_resources)
def scan_container_conf(self, conf, metadata):
if "spec" in conf:
containers = conf["spec"].get("containers", [])
for container in containers:
security_context = container.get("securityContext", {})
if security_context.get("allowPrivilegeEscalation", True):
return CheckResult.FAILED
return CheckResult.PASSED
return CheckResult.PASSED
scanner = KubernetesNoPrivilegeEscalationCheck()`
Version (please complete the following information):
Checkov Version v3.2.256
Additional context
I'm downloading them in the azure devops pipeline, and I've been checking they're all there. Originally there was a syntax error which failed the scan, I fixed that, and it all runs clean but the custom policies aren't in the Tests - Pass, Fail, not impacted, etc.
Any ideas?
The text was updated successfully, but these errors were encountered:
@DerekTheBrave can you provide info on how did you run your scan?
If you are adding a custom policy in a specific location, please remember to use --external-checks-dir to support it.
Describe the issue
I've been writing some Custom Policies, and I've tried both yaml and Python. These are scanning Terraform AKS clusters, there's not a huge amount of code being scanned. However the built-in scans are showing up in the results, not the custom ones.
Examples
Here's an example of one of them: -
int.py
from .kubernetes_no_privilege_escalation_check import KubernetesNoPrivilegeEscalationCheck
`from checkov.common.models.enums import CheckCategories, CheckResult
from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck
class KubernetesNoPrivilegeEscalationCheck(BaseK8sContainerCheck):
def init(self):
name = "Ensure Kubernetes containers do not allow privilege escalation"
id = "CUSTOM_K8S_6"
supported_resources = [
"kubernetes_pod",
"kubernetes_deployment",
"kubernetes_stateful_set",
"kubernetes_daemonset",
"kubernetes_replica_set"
]
categories = [CheckCategories.KUBERNETES]
super().init(name=name, id=id, categories=categories, supported_entities=supported_resources)
scanner = KubernetesNoPrivilegeEscalationCheck()`
Version (please complete the following information):
Additional context
I'm downloading them in the azure devops pipeline, and I've been checking they're all there. Originally there was a syntax error which failed the scan, I fixed that, and it all runs clean but the custom policies aren't in the Tests - Pass, Fail, not impacted, etc.
Any ideas?
The text was updated successfully, but these errors were encountered: