TATAR-Kuber Security Report

Кластер: demo-prod · Горим: offline · 2026-09-27T11:21:49Z

Гүйцэтгэх хураангуй

19/100
Critical
2
Critical
18
High
34
Medium
19
Low
2
Info
0
Blind Shot

Гол эрсдэлүүд — оноо задаргаа

  1. Container image дахь CRITICAL CVE −18 (4%)
    TATAR-IMG-001 · production/deployment/api
    10 × 1.5 × 1 × 1.2
  2. Эрх өсгөлтийг зөвшөөрсөн −12.6 (2.8%)
    TATAR-CON-003 · production/deployment/root-app
    7 × 1.5 × 1 × 1.2
  3. Аюултай capability нэмсэн −12.6 (2.8%)
    TATAR-CON-004 · production/deployment/root-app
    7 × 1.5 × 1 × 1.2
  4. Эрх нэмэгдүүлсэн (privileged) контейнер −12.6 (2.8%)
    TATAR-CON-001 · production/deployment/privileged-app
    7 × 1.5 × 1 × 1.2
  5. Host сүлжээ идэвхжсэн −12.6 (2.8%)
    TATAR-CON-006 · production/deployment/host-ns-app
    7 × 1.5 × 1 × 1.2

Зөвлөмж

  • Base image/багцыг шинэчилж эсвэл patch хийнэ.
  • securityContext.allowPrivilegeEscalation=false.
  • Шаардлагагүй capability-г drop хийнэ; ALL-ыг drop эхлэлээ.
  • securityContext.privileged=false болгоно.
  • hostNetwork=false.

Онооны задаргаа

Томьёо100/(1+P/100)
Нийт торгууль (P)427.4
Crit/High/Med417.4
LOW сан34.2 → 10 (хязгаарлав 10)
суурь × орчин × ил гарц × итгэл

ATT&CK эрсдэл — боломжжуулна

Privilege Escalation11
Credential Access6
Discovery6
Persistence1

Scanner хамрах хүрээ

scanner бүр энэ scan-д бодитоор юу өгснийг харуулна — унасан/хоосон scanner нуугдахгүй
ScannerТөлөвХугацааТүүхий findingЗураглалгүй rule
trivy 0.67.2 ingested — 5 —
kubescape 3.1.4 ingested — 3 —
checkov 3.2.10 ingested — 89 19 (9 rule)
popeye 0.22.1 ingested — 6 —
↳ 3 — Pod хэмжээний finding эзэмшигч controller руу зөөгдсөн — нэг зөрчил нэг удаа тоологдоно (1 pod)

Кластерын нөөц

27
ClusterRoles
31
Deployments
6
Ingresses
8
Namespaces
5
Nodes
142
Pods
54
Services

Илрүүлэлтүүд (75)

Ноцтой байдалКонтролНөөцГарчигНотолгооЗасварИлрүүлсэнИтгэл
CRITICAL TATAR-IMG-001
Image Security
CVE-2024-0001		 production/deployment/api Container image дахь CRITICAL CVE
Эх сурвалж
• Trivy Advisory
trivy openssl@3.1.0 (fixed in 3.1.4)
 Base image/багцыг шинэчилж эсвэл patch хийнэ. trivy HIGH
−18
CRITICAL TATAR-RBAC-001
RBAC & Authorization
⚔ T1078		 clusterrolebinding/admin-bind cluster-admin эрхийг хэт олгосон — cluster-admin-ийг хязгаарлаж, тодорхой scoped role ашиглана. kubescape HIGH
−12
HIGH TATAR-CON-003
Container Security
⚔ T1611		 production/deployment/root-app Эрх өсгөлтийг зөвшөөрсөн
checkov /lab/broken/root-user.yaml:2-20
 securityContext.allowPrivilegeEscalation=false. checkov HIGH
−12.6
HIGH TATAR-CON-004
Container Security		 production/deployment/root-app Аюултай capability нэмсэн
checkov /lab/broken/root-user.yaml:2-20
 Шаардлагагүй capability-г drop хийнэ; ALL-ыг drop эхлэлээ. checkov HIGH
−12.6
HIGH TATAR-CON-001
Container Security
⚔ T1611		 production/deployment/privileged-app Эрх нэмэгдүүлсэн (privileged) контейнер
checkov /lab/broken/privileged.yaml:2-18
 securityContext.privileged=false болгоно. checkov HIGH
−12.6
HIGH TATAR-CON-006
Container Security
⚔ T1611		 production/deployment/host-ns-app Host сүлжээ идэвхжсэн
checkov /lab/broken/host-namespaces.yaml:2-19
 hostNetwork=false. checkov HIGH
−12.6
HIGH TATAR-IMG-002
Image Security
CVE-2024-0002		 production/deployment/api Container image дахь HIGH CVE
Эх сурвалж
• Trivy Advisory
trivy libcurl@8.1.0 (fixed in 8.1.2)
 Base image/багцыг шинэчилнэ. trivy HIGH
−12.6
HIGH TATAR-CON-003
Container Security
⚔ T1611		 production/deployment/latest-app Эрх өсгөлтийг зөвшөөрсөн
checkov /lab/broken/latest-tag.yaml:2-16
 securityContext.allowPrivilegeEscalation=false. checkov HIGH
−12.6
HIGH TATAR-CON-003
Container Security
⚔ T1611		 production/deployment/privileged-app Эрх өсгөлтийг зөвшөөрсөн
checkov /lab/broken/privileged.yaml:2-18
 securityContext.allowPrivilegeEscalation=false. checkov HIGH
−12.6
HIGH TATAR-CON-004
Container Security		 production/deployment/host-ns-app Аюултай capability нэмсэн
checkov /lab/broken/host-namespaces.yaml:2-19
 Шаардлагагүй capability-г drop хийнэ; ALL-ыг drop эхлэлээ. checkov HIGH
−12.6
HIGH TATAR-CON-004
Container Security		 production/deployment/latest-app Аюултай capability нэмсэн
checkov /lab/broken/latest-tag.yaml:2-16
 Шаардлагагүй capability-г drop хийнэ; ALL-ыг drop эхлэлээ. checkov HIGH
−12.6
HIGH TATAR-CON-003
Container Security
⚔ T1611		 production/deployment/secret-env-app Эрх өсгөлтийг зөвшөөрсөн
checkov /lab/broken/secret-env.yaml:2-21
 securityContext.allowPrivilegeEscalation=false. checkov HIGH
−12.6
HIGH TATAR-CON-001
Container Security
⚔ T1611		 production/deployment/api Эрх нэмэгдүүлсэн (privileged) контейнер
Эх сурвалж
• Trivy Advisory
• docs.prismacloud.io
checkov /lab/broken/api.yaml:1-22
trivy spec.template.spec.containers[0].securityContext.privileged
 securityContext.privileged=false болгоно. checkov • kubescape • trivy HIGH
−12.6
HIGH TATAR-CON-003
Container Security
⚔ T1611		 production/deployment/host-ns-app Эрх өсгөлтийг зөвшөөрсөн
checkov /lab/broken/host-namespaces.yaml:2-19
 securityContext.allowPrivilegeEscalation=false. checkov HIGH
−12.6
HIGH TATAR-CON-005
Container Security
⚔ T1611		 production/deployment/host-ns-app Host PID namespace хуваалцсан
checkov /lab/broken/host-namespaces.yaml:2-19
 hostPID=false. checkov HIGH
−12.6
HIGH TATAR-CON-004
Container Security		 production/deployment/privileged-app Аюултай capability нэмсэн
checkov /lab/broken/privileged.yaml:2-18
 Шаардлагагүй capability-г drop хийнэ; ALL-ыг drop эхлэлээ. checkov HIGH
−12.6
HIGH TATAR-CON-004
Container Security		 production/deployment/secret-env-app Аюултай capability нэмсэн
checkov /lab/broken/secret-env.yaml:2-21
 Шаардлагагүй capability-г drop хийнэ; ALL-ыг drop эхлэлээ. checkov HIGH
−12.6
HIGH TATAR-SEC-001
Secret Management
⚔ T1552.007		 default/pod/worker Env хувьсагчид ил гарсан secret
trivy env: AWS_ACCESS_KEY_ID=AKIA********
 Kubernetes Secret + volume mount ашиглана. trivy HIGH
−8.4
HIGH TATAR-RBAC-002
RBAC & Authorization
⚔ T1078		 default/clusterrole/too-powerful Role дахь wildcard эрх
checkov /lab/broken/wildcard-rbac.yaml:2-10
 Эрхийг тодорхой resource/verb болгож нарийсгана. checkov HIGH
−8.4
HIGH TATAR-RBAC-003
RBAC & Authorization		 default/clusterrole/too-powerful Хэт их / эрсдэлтэй эрх
checkov /lab/broken/wildcard-rbac.yaml:2-10
 Least-privilege зарчмаар эрхийг цэвэрлэнэ. checkov MEDIUM
−7
MEDIUM TATAR-CON-009
Container Security		 production/deployment/privileged-app Уншихад зориулсан root файлын систем идэвхгүй
checkov /lab/broken/privileged.yaml:2-18
 securityContext.readOnlyRootFilesystem=true. checkov HIGH
−5.4
MEDIUM TATAR-CON-008
Container Security		 production/deployment/privileged-app securityContext дутуу
checkov /lab/broken/privileged.yaml:2-18
 securityContext блок нэмж hardening тохируулна. checkov HIGH
−5.4
MEDIUM TATAR-CON-008
Container Security		 production/deployment/host-ns-app securityContext дутуу
checkov /lab/broken/host-namespaces.yaml:2-19
 securityContext блок нэмж hardening тохируулна. checkov HIGH
−5.4
MEDIUM TATAR-SEC-003
Secret Management
⚔ T1528		 production/deployment/latest-app SA token автоматаар холбогдсон
checkov /lab/broken/latest-tag.yaml:2-16
 automountServiceAccountToken=false. checkov HIGH
−5.4
MEDIUM TATAR-SEC-003
Secret Management
⚔ T1528		 production/deployment/host-ns-app SA token автоматаар холбогдсон
checkov /lab/broken/host-namespaces.yaml:2-19
 automountServiceAccountToken=false. checkov HIGH
−5.4
MEDIUM TATAR-CON-008
Container Security		 production/deployment/latest-app securityContext дутуу
checkov /lab/broken/latest-tag.yaml:2-16
 securityContext блок нэмж hardening тохируулна. checkov HIGH
−5.4
MEDIUM TATAR-CON-009
Container Security		 production/deployment/latest-app Уншихад зориулсан root файлын систем идэвхгүй
checkov /lab/broken/latest-tag.yaml:2-16
 securityContext.readOnlyRootFilesystem=true. checkov HIGH
−5.4
MEDIUM TATAR-CON-009
Container Security		 production/deployment/secret-env-app Уншихад зориулсан root файлын систем идэвхгүй
checkov /lab/broken/secret-env.yaml:2-21
 securityContext.readOnlyRootFilesystem=true. checkov HIGH
−5.4
MEDIUM TATAR-CON-011
Container Security		 production/deployment/privileged-app Default seccomp profile тохируулаагүй
checkov /lab/broken/privileged.yaml:2-18
 seccompProfile.type=RuntimeDefault. checkov HIGH
−5.4
MEDIUM TATAR-CON-002
Container Security		 production/deployment/privileged-app Root эрхээр ажиллаж буй контейнер
checkov /lab/broken/privileged.yaml:2-18
 securityContext.runAsNonRoot=true тохируулна. checkov HIGH
−5.4
MEDIUM TATAR-CON-009
Container Security		 production/deployment/root-app Уншихад зориулсан root файлын систем идэвхгүй
checkov /lab/broken/root-user.yaml:2-20
 securityContext.readOnlyRootFilesystem=true. checkov HIGH
−5.4
MEDIUM TATAR-CON-002
Container Security		 production/deployment/host-ns-app Root эрхээр ажиллаж буй контейнер
checkov /lab/broken/host-namespaces.yaml:2-19
 securityContext.runAsNonRoot=true тохируулна. checkov HIGH
−5.4
MEDIUM TATAR-CON-011
Container Security		 production/deployment/latest-app Default seccomp profile тохируулаагүй
checkov /lab/broken/latest-tag.yaml:2-16
 seccompProfile.type=RuntimeDefault. checkov HIGH
−5.4
MEDIUM TATAR-CON-002
Container Security		 production/deployment/root-app Root эрхээр ажиллаж буй контейнер
checkov /lab/broken/root-user.yaml:2-20
 securityContext.runAsNonRoot=true тохируулна. checkov HIGH
−5.4
MEDIUM TATAR-CON-002
Container Security		 production/deployment/api Root эрхээр ажиллаж буй контейнер
trivy spec.template.spec.containers[0].securityContext.runAsNonRoot
 securityContext.runAsNonRoot=true тохируулна. trivy HIGH
−5.4
MEDIUM TATAR-CON-011
Container Security		 production/deployment/secret-env-app Default seccomp profile тохируулаагүй
checkov /lab/broken/secret-env.yaml:2-21
 seccompProfile.type=RuntimeDefault. checkov HIGH
−5.4
MEDIUM TATAR-IMG-003
Image Security
⚔ T1525		 production/deployment/latest-app Image :latest tag ашигласан
checkov /lab/broken/latest-tag.yaml:2-16
popeye container-xImage tagged "latest" in use (popeye warning)
popeye pod/latest-app-598c4dc6b8-ldjqqrolled up to deployment/latest-app
 Тодорхой хувилбар (digest/tag) ашиглана. checkov • popeye HIGH
−5.4
MEDIUM TATAR-SEC-003
Secret Management
⚔ T1528		 production/deployment/root-app SA token автоматаар холбогдсон
checkov /lab/broken/root-user.yaml:2-20
 automountServiceAccountToken=false. checkov HIGH
−5.4
MEDIUM TATAR-CON-011
Container Security		 production/deployment/host-ns-app Default seccomp profile тохируулаагүй
checkov /lab/broken/host-namespaces.yaml:2-19
 seccompProfile.type=RuntimeDefault. checkov HIGH
−5.4
MEDIUM TATAR-CON-008
Container Security		 production/deployment/secret-env-app securityContext дутуу
checkov /lab/broken/secret-env.yaml:2-21
 securityContext блок нэмж hardening тохируулна. checkov HIGH
−5.4
MEDIUM TATAR-SEC-003
Secret Management
⚔ T1528		 production/deployment/privileged-app SA token автоматаар холбогдсон
checkov /lab/broken/privileged.yaml:2-18
 automountServiceAccountToken=false. checkov HIGH
−5.4
MEDIUM TATAR-NET-001
Network Security
⚔ T1046		 production/deployment/api NetworkPolicy дутуу — Namespace бүрт NetworkPolicy тодорхойлно. kubescape HIGH
−5.4
MEDIUM TATAR-CON-011
Container Security		 production/deployment/root-app Default seccomp profile тохируулаагүй
checkov /lab/broken/root-user.yaml:2-20
 seccompProfile.type=RuntimeDefault. checkov HIGH
−5.4
MEDIUM TATAR-CON-008
Container Security		 production/deployment/root-app securityContext дутуу
checkov /lab/broken/root-user.yaml:2-20
 securityContext блок нэмж hardening тохируулна. checkov HIGH
−5.4
MEDIUM TATAR-CON-009
Container Security		 production/deployment/host-ns-app Уншихад зориулсан root файлын систем идэвхгүй
checkov /lab/broken/host-namespaces.yaml:2-19
 securityContext.readOnlyRootFilesystem=true. checkov HIGH
−5.4
MEDIUM TATAR-CON-002
Container Security		 production/deployment/latest-app Root эрхээр ажиллаж буй контейнер
checkov /lab/broken/latest-tag.yaml:2-16
 securityContext.runAsNonRoot=true тохируулна. checkov HIGH
−5.4
MEDIUM TATAR-SEC-003
Secret Management
⚔ T1528		 production/deployment/secret-env-app SA token автоматаар холбогдсон
checkov /lab/broken/secret-env.yaml:2-21
 automountServiceAccountToken=false. checkov HIGH
−5.4
MEDIUM TATAR-RBAC-005
RBAC & Authorization		 production/pod/latest-app-598c4dc6b8-ldjqq Default service account ашиглаж байна
popeye Uses "default" ServiceAccount (popeye warning)
 Workload бүрт тусгай, least-privilege SA үүсгэнэ. popeye HIGH
−5.4
MEDIUM TATAR-CON-002
Container Security		 production/deployment/secret-env-app Root эрхээр ажиллаж буй контейнер
checkov /lab/broken/secret-env.yaml:2-21
 securityContext.runAsNonRoot=true тохируулна. checkov HIGH
−5.4
MEDIUM TATAR-NET-001
Network Security
⚔ T1046		 pod/app-latest-app NetworkPolicy дутуу
checkov /lab/broken/latest-tag.yaml:2-16
 Namespace бүрт NetworkPolicy тодорхойлно. checkov HIGH
−3.6
MEDIUM TATAR-NET-001
Network Security
⚔ T1046		 pod/app-root-app NetworkPolicy дутуу
checkov /lab/broken/root-user.yaml:2-20
 Namespace бүрт NetworkPolicy тодорхойлно. checkov HIGH
−3.6
MEDIUM TATAR-NET-001
Network Security
⚔ T1046		 pod/app-privileged-app NetworkPolicy дутуу
checkov /lab/broken/privileged.yaml:2-18
 Namespace бүрт NetworkPolicy тодорхойлно. checkov HIGH
−3.6
MEDIUM TATAR-NET-001
Network Security
⚔ T1046		 pod/app-secret-env-app NetworkPolicy дутуу
checkov /lab/broken/secret-env.yaml:2-21
 Namespace бүрт NetworkPolicy тодорхойлно. checkov HIGH
−3.6
MEDIUM TATAR-NET-001
Network Security
⚔ T1046		 pod/app-host-ns-app NetworkPolicy дутуу
checkov /lab/broken/host-namespaces.yaml:2-19
 Namespace бүрт NetworkPolicy тодорхойлно. checkov HIGH
−3.6
LOW TATAR-OPS-005
Operational Health		 production/deployment/root-app imagePullPolicy зөв тохируулаагүй
checkov /lab/broken/root-user.yaml:2-20
 imagePullPolicy-г IfNotPresent/Always болгож тодорхой заана. checkov HIGH
−1.8
LOW TATAR-CON-010
Container Security		 production/deployment/secret-env-app CPU/санах ойн хязгаар дутуу
checkov /lab/broken/secret-env.yaml:2-21
 resources.limits.cpu болон .memory тохируулна. checkov HIGH
−1.8
LOW TATAR-OPS-002
Operational Health		 production/deployment/host-ns-app liveness probe дутуу
checkov /lab/broken/host-namespaces.yaml:2-19
 livenessProbe нэмнэ. checkov HIGH
−1.8
LOW TATAR-OPS-001
Operational Health		 production/deployment/secret-env-app readiness probe дутуу
checkov /lab/broken/secret-env.yaml:2-21
 readinessProbe нэмнэ. checkov HIGH
−1.8
LOW TATAR-OPS-002
Operational Health		 production/deployment/secret-env-app liveness probe дутуу
checkov /lab/broken/secret-env.yaml:2-21
 livenessProbe нэмнэ. checkov HIGH
−1.8
LOW TATAR-OPS-001
Operational Health		 production/deployment/privileged-app readiness probe дутуу
checkov /lab/broken/privileged.yaml:2-18
 readinessProbe нэмнэ. checkov HIGH
−1.8
LOW TATAR-OPS-005
Operational Health		 production/deployment/privileged-app imagePullPolicy зөв тохируулаагүй
checkov /lab/broken/privileged.yaml:2-18
 imagePullPolicy-г IfNotPresent/Always болгож тодорхой заана. checkov HIGH
−1.8
LOW TATAR-CON-010
Container Security		 production/deployment/privileged-app CPU/санах ойн хязгаар дутуу
checkov /lab/broken/privileged.yaml:2-18
 resources.limits.cpu болон .memory тохируулна. checkov HIGH
−1.8
LOW TATAR-OPS-002
Operational Health		 production/deployment/privileged-app liveness probe дутуу
checkov /lab/broken/privileged.yaml:2-18
 livenessProbe нэмнэ. checkov HIGH
−1.8
LOW TATAR-CON-010
Container Security		 production/deployment/root-app CPU/санах ойн хязгаар дутуу
checkov /lab/broken/root-user.yaml:2-20
 resources.limits.cpu болон .memory тохируулна. checkov HIGH
−1.8
LOW TATAR-OPS-005
Operational Health		 production/deployment/host-ns-app imagePullPolicy зөв тохируулаагүй
checkov /lab/broken/host-namespaces.yaml:2-19
 imagePullPolicy-г IfNotPresent/Always болгож тодорхой заана. checkov HIGH
−1.8
LOW TATAR-OPS-002
Operational Health		 production/deployment/latest-app liveness probe дутуу
checkov /lab/broken/latest-tag.yaml:2-16
 livenessProbe нэмнэ. checkov HIGH
−1.8
LOW TATAR-OPS-002
Operational Health		 production/deployment/root-app liveness probe дутуу
checkov /lab/broken/root-user.yaml:2-20
 livenessProbe нэмнэ. checkov HIGH
−1.8
LOW TATAR-OPS-001
Operational Health		 production/deployment/latest-app readiness probe дутуу
checkov /lab/broken/latest-tag.yaml:2-16
popeye container-xNo probes defined (popeye warning)
popeye pod/latest-app-598c4dc6b8-ldjqqrolled up to deployment/latest-app
 readinessProbe нэмнэ. checkov • popeye HIGH
−1.8
LOW TATAR-OPS-001
Operational Health		 production/deployment/host-ns-app readiness probe дутуу
checkov /lab/broken/host-namespaces.yaml:2-19
 readinessProbe нэмнэ. checkov HIGH
−1.8
LOW TATAR-CON-010
Container Security		 production/deployment/latest-app CPU/санах ойн хязгаар дутуу
checkov /lab/broken/latest-tag.yaml:2-16
popeye container-xNo resources requests/limits defined (popeye warning)
popeye pod/latest-app-598c4dc6b8-ldjqqrolled up to deployment/latest-app
 resources.limits.cpu болон .memory тохируулна. checkov • popeye HIGH
−1.8
LOW TATAR-OPS-005
Operational Health		 production/deployment/secret-env-app imagePullPolicy зөв тохируулаагүй
checkov /lab/broken/secret-env.yaml:2-21
 imagePullPolicy-г IfNotPresent/Always болгож тодорхой заана. checkov HIGH
−1.8
LOW TATAR-CON-010
Container Security		 production/deployment/host-ns-app CPU/санах ойн хязгаар дутуу
checkov /lab/broken/host-namespaces.yaml:2-19
 resources.limits.cpu болон .memory тохируулна. checkov HIGH
−1.8
LOW TATAR-OPS-001
Operational Health		 production/deployment/root-app readiness probe дутуу
checkov /lab/broken/root-user.yaml:2-20
 readinessProbe нэмнэ. checkov HIGH
−1.8
INFO TATAR-OPS-003
Operational Health		 production/service/orphan-svc Эзэнгүй / идэвхгүй service (endpoint-гүй)
popeye No pods match service selector (popeye warning)
 Service-ийг устгах эсвэл selector-ыг засна. popeye HIGH
INFO TATAR-OPS-004
Operational Health		 production/configmap/unused-cm Ашиглагдаагүй ConfigMap / Secret
popeye Used? Unable to locate resource reference (popeye info)
 Ашиглагдаагүй объектыг устгана. popeye HIGH