bug(helm): sometimes the report does not contain a code

[nikpivkin]

In this example, Helm Chart contains two templates . On scanning the report will not contain the code of findings of deployment.yaml file. But deleting the manifest.yaml file solves the problem.

Code

File tree:

tree
.
├── Chart.yaml
└── templates
    ├── deployment.yaml
    └── manifest.yaml

2 directories, 4 files

deployment.yaml:

apiVersion: apps/v1
kind: Deployment
spec:
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp
        image: test:latest
        resources:
          limits:
            memory: "128Mi"
            cpu: "500m"
        ports:
        - containerPort: 80

manifest.yaml:

apiVersion: apps/v1
kind: Deployment

Chart.yaml:

apiVersion: v2
name: test
description: A Helm chart for Kubernetes
type: application
version: 0.1.0
appVersion: "1.16.0"

Output:

Output with manifest.yaml:

templates/deployment.yaml (helm)

Tests: 152 (SUCCESSES: 150, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (UNKNOWN: 0, LOW: 2, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

LOW: Either Pod or Container should set 'securityContext.seccompProfile.type' to 'RuntimeDefault'
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
According to pod security standard 'Seccomp', the RuntimeDefault seccomp profile must be required, or allow specific additional profiles.

See https://avd.aquasec.com/misconfig/ksv030
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────


LOW: container should drop all
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.

See https://avd.aquasec.com/misconfig/ksv106
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Output without manifest.yaml:

templates/deployment.yaml (helm)

Tests: 152 (SUCCESSES: 150, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (UNKNOWN: 0, LOW: 2, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

LOW: Either Pod or Container should set 'securityContext.seccompProfile.type' to 'RuntimeDefault'
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
According to pod security standard 'Seccomp', the RuntimeDefault seccomp profile must be required, or allow specific additional profiles.

See https://avd.aquasec.com/misconfig/ksv030
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 templates/deployment.yaml:14-21
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  14 ┌       - name: myapp
  15 │         image: test:latest
  16 │         resources:
  17 │           limits:
  18 │             memory: "128Mi"
  19 │             cpu: "500m"
  20 │         ports:
  21 └         - containerPort: 80
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────


LOW: container should drop all
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.

See https://avd.aquasec.com/misconfig/ksv106
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 templates/deployment.yaml:14-21
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  14 ┌       - name: myapp
  15 │         image: test:latest
  16 │         resources:
  17 │           limits:
  18 │             memory: "128Mi"
  19 │             cpu: "500m"
  20 │         ports:
  21 └         - containerPort: 80
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────