🎉 Add Trivy Operator clustercompliance report

[manuel-sommer]

• Enables Trivy Operator to parse the clustercompliance report.
• Refactoring of trivy operator parser to have it better structured.

[dryrunsecurity]

DryRun Security Summary

The pull request enhances the functionality and security of the Trivy Operator, a tool for scanning Kubernetes clusters and workloads, by adding a new test case, improving the output_findings function, introducing the TrivyClusterComplianceHandler class, and updating the clustercompliancereport.json file to include the configuration and reporting for the Kubernetes cluster's compliance with the CIS Kubernetes Benchmarks.

Expand for full summary

Summary:

The code changes in this pull request focus on enhancing the functionality and security of the Trivy Operator, a tool for scanning Kubernetes clusters and workloads for vulnerabilities, secrets, and configuration issues. The key changes include:

1. Addition of a new test case to the TestTrivyOperatorParser class, which ensures that the TrivyOperatorParser can correctly handle and parse the "clustercompliancereport.json" file format. This type of testing helps improve the overall robustness and reliability of the application security tooling.

2. Improvements to the output_findings function in the dojo/tools/trivy_operator/parser.py file, which now includes the ability to process cluster compliance reports generated by the Trivy Operator. This enhances the tool's capability to identify configuration issues and policy violations in Kubernetes environments, which is crucial for maintaining a secure infrastructure.

3. Introduction of the TrivyClusterComplianceHandler class, which is responsible for processing the results of the cluster compliance checks and generating findings based on the results. This class maps the severities of the Trivy findings to a predefined set of severities, ensuring consistency in the way the findings are reported and classified.

4. Changes to the clustercompliancereport.json file, which includes the configuration and reporting for the Kubernetes cluster's compliance with the CIS Kubernetes Benchmarks. This helps identify and address security vulnerabilities and misconfigurations in the Kubernetes cluster, contributing to a more secure and compliant infrastructure.

Overall, these changes are a positive step towards enhancing the security capabilities of the Trivy Operator and improving the overall security of Kubernetes environments.

Files Changed:

1. unittests/tools/test_trivy_operator_parser.py: This file adds a new test case to the TestTrivyOperatorParser class, which ensures that the TrivyOperatorParser can correctly handle the "clustercompliancereport.json" file format.

2. dojo/tools/trivy_operator/parser.py: The changes in this file include the addition of the TrivyClusterComplianceHandler class and enhancements to the output_findings function to handle cluster compliance reports generated by the Trivy Operator.

3. unittests/scans/trivy_operator/clustercompliancereport.json: This file contains the configuration and reporting for the Kubernetes cluster's compliance with the CIS Kubernetes Benchmarks, including three compliance checks related to the Kubernetes cluster's configuration.

4. dojo/tools/trivy_operator/clustercompliance_handler.py: This file contains the implementation of the TrivyClusterComplianceHandler class, which is responsible for processing the results of the cluster compliance checks and generating findings based on the results.

Code Analysis

We ran 9 analyzers against 4 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Approved