TATAR-Kuber Security Report

Cluster: demo-prod · Mode: offline · 2026-09-27T11:21:49Z

Executive Summary

19/100
Critical
2
Critical
18
High
34
Medium
19
Low
2
Info
0
Blind Shot

Top Risks — score breakdown

  1. Critical CVE in container image −18 (4%)
    TATAR-IMG-001 · production/deployment/api
    10 × 1.5 × 1 × 1.2
  2. Allow privilege escalation −12.6 (2.8%)
    TATAR-CON-003 · production/deployment/root-app
    7 × 1.5 × 1 × 1.2
  3. Dangerous capabilities added −12.6 (2.8%)
    TATAR-CON-004 · production/deployment/root-app
    7 × 1.5 × 1 × 1.2
  4. Privileged container enabled −12.6 (2.8%)
    TATAR-CON-001 · production/deployment/privileged-app
    7 × 1.5 × 1 × 1.2
  5. Host network enabled −12.6 (2.8%)
    TATAR-CON-006 · production/deployment/host-ns-app
    7 × 1.5 × 1 × 1.2

Recommendations

  • Update the base image/package or apply a patch.
  • Set securityContext.allowPrivilegeEscalation=false.
  • Drop unnecessary capabilities; start by dropping ALL.
  • Set securityContext.privileged=false.
  • Set hostNetwork=false.

Score breakdown

Formula100/(1+P/100)
Total penalty (P)427.4
Crit/High/Med417.4
LOW pool34.2 → 10 (capped 10)
base × context × exposure × confidence

ATT&CK exposure — may enable

Privilege Escalation11
Credential Access6
Discovery6
Persistence1

Scanner coverage

what each scanner actually contributed to this scan — a failed or empty scanner is shown, never hidden
ScannerStatusDurationRaw findingsUnmapped rules
trivy 0.67.2 ingested — 5 —
kubescape 3.1.4 ingested — 3 —
checkov 3.2.10 ingested — 89 19 (9 rule)
popeye 0.22.1 ingested — 6 —
↳ 3 — Pod-scoped findings rolled up to their owning controller, so one misconfiguration is counted once (1 pod)

Cluster Inventory

27
ClusterRoles
31
Deployments
6
Ingresses
8
Namespaces
5
Nodes
142
Pods
54
Services

Findings (75)

SeverityControlResourceTitleEvidenceFixFound byConf.
CRITICAL TATAR-IMG-001
Image Security
CVE-2024-0001		 production/deployment/api Critical CVE in container image
References
• Trivy Advisory
trivy openssl@3.1.0 (fixed in 3.1.4)
 Update the base image/package or apply a patch. trivy HIGH
−18
CRITICAL TATAR-RBAC-001
RBAC & Authorization
⚔ T1078		 clusterrolebinding/admin-bind cluster-admin binding overuse — Restrict cluster-admin; use specific scoped roles. kubescape HIGH
−12
HIGH TATAR-CON-003
Container Security
⚔ T1611		 production/deployment/root-app Allow privilege escalation
checkov /lab/broken/root-user.yaml:2-20
 Set securityContext.allowPrivilegeEscalation=false. checkov HIGH
−12.6
HIGH TATAR-CON-004
Container Security		 production/deployment/root-app Dangerous capabilities added
checkov /lab/broken/root-user.yaml:2-20
 Drop unnecessary capabilities; start by dropping ALL. checkov HIGH
−12.6
HIGH TATAR-CON-001
Container Security
⚔ T1611		 production/deployment/privileged-app Privileged container enabled
checkov /lab/broken/privileged.yaml:2-18
 Set securityContext.privileged=false. checkov HIGH
−12.6
HIGH TATAR-CON-006
Container Security
⚔ T1611		 production/deployment/host-ns-app Host network enabled
checkov /lab/broken/host-namespaces.yaml:2-19
 Set hostNetwork=false. checkov HIGH
−12.6
HIGH TATAR-IMG-002
Image Security
CVE-2024-0002		 production/deployment/api High CVE in container image
References
• Trivy Advisory
trivy libcurl@8.1.0 (fixed in 8.1.2)
 Update the base image/package. trivy HIGH
−12.6
HIGH TATAR-CON-003
Container Security
⚔ T1611		 production/deployment/latest-app Allow privilege escalation
checkov /lab/broken/latest-tag.yaml:2-16
 Set securityContext.allowPrivilegeEscalation=false. checkov HIGH
−12.6
HIGH TATAR-CON-003
Container Security
⚔ T1611		 production/deployment/privileged-app Allow privilege escalation
checkov /lab/broken/privileged.yaml:2-18
 Set securityContext.allowPrivilegeEscalation=false. checkov HIGH
−12.6
HIGH TATAR-CON-004
Container Security		 production/deployment/host-ns-app Dangerous capabilities added
checkov /lab/broken/host-namespaces.yaml:2-19
 Drop unnecessary capabilities; start by dropping ALL. checkov HIGH
−12.6
HIGH TATAR-CON-004
Container Security		 production/deployment/latest-app Dangerous capabilities added
checkov /lab/broken/latest-tag.yaml:2-16
 Drop unnecessary capabilities; start by dropping ALL. checkov HIGH
−12.6
HIGH TATAR-CON-003
Container Security
⚔ T1611		 production/deployment/secret-env-app Allow privilege escalation
checkov /lab/broken/secret-env.yaml:2-21
 Set securityContext.allowPrivilegeEscalation=false. checkov HIGH
−12.6
HIGH TATAR-CON-001
Container Security
⚔ T1611		 production/deployment/api Privileged container enabled
References
• Trivy Advisory
• docs.prismacloud.io
checkov /lab/broken/api.yaml:1-22
trivy spec.template.spec.containers[0].securityContext.privileged
 Set securityContext.privileged=false. checkov • kubescape • trivy HIGH
−12.6
HIGH TATAR-CON-003
Container Security
⚔ T1611		 production/deployment/host-ns-app Allow privilege escalation
checkov /lab/broken/host-namespaces.yaml:2-19
 Set securityContext.allowPrivilegeEscalation=false. checkov HIGH
−12.6
HIGH TATAR-CON-005
Container Security
⚔ T1611		 production/deployment/host-ns-app Host PID namespace shared
checkov /lab/broken/host-namespaces.yaml:2-19
 Set hostPID=false. checkov HIGH
−12.6
HIGH TATAR-CON-004
Container Security		 production/deployment/privileged-app Dangerous capabilities added
checkov /lab/broken/privileged.yaml:2-18
 Drop unnecessary capabilities; start by dropping ALL. checkov HIGH
−12.6
HIGH TATAR-CON-004
Container Security		 production/deployment/secret-env-app Dangerous capabilities added
checkov /lab/broken/secret-env.yaml:2-21
 Drop unnecessary capabilities; start by dropping ALL. checkov HIGH
−12.6
HIGH TATAR-SEC-001
Secret Management
⚔ T1552.007		 default/pod/worker Secret exposed in environment variable
trivy env: AWS_ACCESS_KEY_ID=AKIA********
 Use Kubernetes Secrets with volume mounts. trivy HIGH
−8.4
HIGH TATAR-RBAC-002
RBAC & Authorization
⚔ T1078		 default/clusterrole/too-powerful Wildcard permissions in role
checkov /lab/broken/wildcard-rbac.yaml:2-10
 Narrow permissions to specific resources/verbs. checkov HIGH
−8.4
HIGH TATAR-RBAC-003
RBAC & Authorization		 default/clusterrole/too-powerful Excessive / risky permissions
checkov /lab/broken/wildcard-rbac.yaml:2-10
 Clean up permissions using least-privilege. checkov MEDIUM
−7
MEDIUM TATAR-CON-009
Container Security		 production/deployment/privileged-app Read-only root filesystem disabled
checkov /lab/broken/privileged.yaml:2-18
 Set securityContext.readOnlyRootFilesystem=true. checkov HIGH
−5.4
MEDIUM TATAR-CON-008
Container Security		 production/deployment/privileged-app Missing securityContext
checkov /lab/broken/privileged.yaml:2-18
 Add a securityContext block with hardening settings. checkov HIGH
−5.4
MEDIUM TATAR-CON-008
Container Security		 production/deployment/host-ns-app Missing securityContext
checkov /lab/broken/host-namespaces.yaml:2-19
 Add a securityContext block with hardening settings. checkov HIGH
−5.4
MEDIUM TATAR-SEC-003
Secret Management
⚔ T1528		 production/deployment/latest-app Service account token auto-mounted
checkov /lab/broken/latest-tag.yaml:2-16
 Set automountServiceAccountToken=false. checkov HIGH
−5.4
MEDIUM TATAR-SEC-003
Secret Management
⚔ T1528		 production/deployment/host-ns-app Service account token auto-mounted
checkov /lab/broken/host-namespaces.yaml:2-19
 Set automountServiceAccountToken=false. checkov HIGH
−5.4
MEDIUM TATAR-CON-008
Container Security		 production/deployment/latest-app Missing securityContext
checkov /lab/broken/latest-tag.yaml:2-16
 Add a securityContext block with hardening settings. checkov HIGH
−5.4
MEDIUM TATAR-CON-009
Container Security		 production/deployment/latest-app Read-only root filesystem disabled
checkov /lab/broken/latest-tag.yaml:2-16
 Set securityContext.readOnlyRootFilesystem=true. checkov HIGH
−5.4
MEDIUM TATAR-CON-009
Container Security		 production/deployment/secret-env-app Read-only root filesystem disabled
checkov /lab/broken/secret-env.yaml:2-21
 Set securityContext.readOnlyRootFilesystem=true. checkov HIGH
−5.4
MEDIUM TATAR-CON-011
Container Security		 production/deployment/privileged-app Default seccomp profile not set
checkov /lab/broken/privileged.yaml:2-18
 Set seccompProfile.type=RuntimeDefault. checkov HIGH
−5.4
MEDIUM TATAR-CON-002
Container Security		 production/deployment/privileged-app Container running as root
checkov /lab/broken/privileged.yaml:2-18
 Set securityContext.runAsNonRoot=true. checkov HIGH
−5.4
MEDIUM TATAR-CON-009
Container Security		 production/deployment/root-app Read-only root filesystem disabled
checkov /lab/broken/root-user.yaml:2-20
 Set securityContext.readOnlyRootFilesystem=true. checkov HIGH
−5.4
MEDIUM TATAR-CON-002
Container Security		 production/deployment/host-ns-app Container running as root
checkov /lab/broken/host-namespaces.yaml:2-19
 Set securityContext.runAsNonRoot=true. checkov HIGH
−5.4
MEDIUM TATAR-CON-011
Container Security		 production/deployment/latest-app Default seccomp profile not set
checkov /lab/broken/latest-tag.yaml:2-16
 Set seccompProfile.type=RuntimeDefault. checkov HIGH
−5.4
MEDIUM TATAR-CON-002
Container Security		 production/deployment/root-app Container running as root
checkov /lab/broken/root-user.yaml:2-20
 Set securityContext.runAsNonRoot=true. checkov HIGH
−5.4
MEDIUM TATAR-CON-002
Container Security		 production/deployment/api Container running as root
trivy spec.template.spec.containers[0].securityContext.runAsNonRoot
 Set securityContext.runAsNonRoot=true. trivy HIGH
−5.4
MEDIUM TATAR-CON-011
Container Security		 production/deployment/secret-env-app Default seccomp profile not set
checkov /lab/broken/secret-env.yaml:2-21
 Set seccompProfile.type=RuntimeDefault. checkov HIGH
−5.4
MEDIUM TATAR-IMG-003
Image Security
⚔ T1525		 production/deployment/latest-app Image uses :latest tag
checkov /lab/broken/latest-tag.yaml:2-16
popeye container-xImage tagged "latest" in use (popeye warning)
popeye pod/latest-app-598c4dc6b8-ldjqqrolled up to deployment/latest-app
 Use a specific version (digest/tag). checkov • popeye HIGH
−5.4
MEDIUM TATAR-SEC-003
Secret Management
⚔ T1528		 production/deployment/root-app Service account token auto-mounted
checkov /lab/broken/root-user.yaml:2-20
 Set automountServiceAccountToken=false. checkov HIGH
−5.4
MEDIUM TATAR-CON-011
Container Security		 production/deployment/host-ns-app Default seccomp profile not set
checkov /lab/broken/host-namespaces.yaml:2-19
 Set seccompProfile.type=RuntimeDefault. checkov HIGH
−5.4
MEDIUM TATAR-CON-008
Container Security		 production/deployment/secret-env-app Missing securityContext
checkov /lab/broken/secret-env.yaml:2-21
 Add a securityContext block with hardening settings. checkov HIGH
−5.4
MEDIUM TATAR-SEC-003
Secret Management
⚔ T1528		 production/deployment/privileged-app Service account token auto-mounted
checkov /lab/broken/privileged.yaml:2-18
 Set automountServiceAccountToken=false. checkov HIGH
−5.4
MEDIUM TATAR-NET-001
Network Security
⚔ T1046		 production/deployment/api Missing NetworkPolicy — Define a NetworkPolicy for each namespace. kubescape HIGH
−5.4
MEDIUM TATAR-CON-011
Container Security		 production/deployment/root-app Default seccomp profile not set
checkov /lab/broken/root-user.yaml:2-20
 Set seccompProfile.type=RuntimeDefault. checkov HIGH
−5.4
MEDIUM TATAR-CON-008
Container Security		 production/deployment/root-app Missing securityContext
checkov /lab/broken/root-user.yaml:2-20
 Add a securityContext block with hardening settings. checkov HIGH
−5.4
MEDIUM TATAR-CON-009
Container Security		 production/deployment/host-ns-app Read-only root filesystem disabled
checkov /lab/broken/host-namespaces.yaml:2-19
 Set securityContext.readOnlyRootFilesystem=true. checkov HIGH
−5.4
MEDIUM TATAR-CON-002
Container Security		 production/deployment/latest-app Container running as root
checkov /lab/broken/latest-tag.yaml:2-16
 Set securityContext.runAsNonRoot=true. checkov HIGH
−5.4
MEDIUM TATAR-SEC-003
Secret Management
⚔ T1528		 production/deployment/secret-env-app Service account token auto-mounted
checkov /lab/broken/secret-env.yaml:2-21
 Set automountServiceAccountToken=false. checkov HIGH
−5.4
MEDIUM TATAR-RBAC-005
RBAC & Authorization		 production/pod/latest-app-598c4dc6b8-ldjqq Default service account in use
popeye Uses "default" ServiceAccount (popeye warning)
 Create a dedicated least-privilege SA per workload. popeye HIGH
−5.4
MEDIUM TATAR-CON-002
Container Security		 production/deployment/secret-env-app Container running as root
checkov /lab/broken/secret-env.yaml:2-21
 Set securityContext.runAsNonRoot=true. checkov HIGH
−5.4
MEDIUM TATAR-NET-001
Network Security
⚔ T1046		 pod/app-latest-app Missing NetworkPolicy
checkov /lab/broken/latest-tag.yaml:2-16
 Define a NetworkPolicy for each namespace. checkov HIGH
−3.6
MEDIUM TATAR-NET-001
Network Security
⚔ T1046		 pod/app-root-app Missing NetworkPolicy
checkov /lab/broken/root-user.yaml:2-20
 Define a NetworkPolicy for each namespace. checkov HIGH
−3.6
MEDIUM TATAR-NET-001
Network Security
⚔ T1046		 pod/app-privileged-app Missing NetworkPolicy
checkov /lab/broken/privileged.yaml:2-18
 Define a NetworkPolicy for each namespace. checkov HIGH
−3.6
MEDIUM TATAR-NET-001
Network Security
⚔ T1046		 pod/app-secret-env-app Missing NetworkPolicy
checkov /lab/broken/secret-env.yaml:2-21
 Define a NetworkPolicy for each namespace. checkov HIGH
−3.6
MEDIUM TATAR-NET-001
Network Security
⚔ T1046		 pod/app-host-ns-app Missing NetworkPolicy
checkov /lab/broken/host-namespaces.yaml:2-19
 Define a NetworkPolicy for each namespace. checkov HIGH
−3.6
LOW TATAR-OPS-005
Operational Health		 production/deployment/root-app imagePullPolicy not set correctly
checkov /lab/broken/root-user.yaml:2-20
 Set imagePullPolicy explicitly to IfNotPresent/Always. checkov HIGH
−1.8
LOW TATAR-CON-010
Container Security		 production/deployment/secret-env-app Missing CPU/memory limits
checkov /lab/broken/secret-env.yaml:2-21
 Set resources.limits.cpu and .memory. checkov HIGH
−1.8
LOW TATAR-OPS-002
Operational Health		 production/deployment/host-ns-app Missing liveness probe
checkov /lab/broken/host-namespaces.yaml:2-19
 Add a livenessProbe. checkov HIGH
−1.8
LOW TATAR-OPS-001
Operational Health		 production/deployment/secret-env-app Missing readiness probe
checkov /lab/broken/secret-env.yaml:2-21
 Add a readinessProbe. checkov HIGH
−1.8
LOW TATAR-OPS-002
Operational Health		 production/deployment/secret-env-app Missing liveness probe
checkov /lab/broken/secret-env.yaml:2-21
 Add a livenessProbe. checkov HIGH
−1.8
LOW TATAR-OPS-001
Operational Health		 production/deployment/privileged-app Missing readiness probe
checkov /lab/broken/privileged.yaml:2-18
 Add a readinessProbe. checkov HIGH
−1.8
LOW TATAR-OPS-005
Operational Health		 production/deployment/privileged-app imagePullPolicy not set correctly
checkov /lab/broken/privileged.yaml:2-18
 Set imagePullPolicy explicitly to IfNotPresent/Always. checkov HIGH
−1.8
LOW TATAR-CON-010
Container Security		 production/deployment/privileged-app Missing CPU/memory limits
checkov /lab/broken/privileged.yaml:2-18
 Set resources.limits.cpu and .memory. checkov HIGH
−1.8
LOW TATAR-OPS-002
Operational Health		 production/deployment/privileged-app Missing liveness probe
checkov /lab/broken/privileged.yaml:2-18
 Add a livenessProbe. checkov HIGH
−1.8
LOW TATAR-CON-010
Container Security		 production/deployment/root-app Missing CPU/memory limits
checkov /lab/broken/root-user.yaml:2-20
 Set resources.limits.cpu and .memory. checkov HIGH
−1.8
LOW TATAR-OPS-005
Operational Health		 production/deployment/host-ns-app imagePullPolicy not set correctly
checkov /lab/broken/host-namespaces.yaml:2-19
 Set imagePullPolicy explicitly to IfNotPresent/Always. checkov HIGH
−1.8
LOW TATAR-OPS-002
Operational Health		 production/deployment/latest-app Missing liveness probe
checkov /lab/broken/latest-tag.yaml:2-16
 Add a livenessProbe. checkov HIGH
−1.8
LOW TATAR-OPS-002
Operational Health		 production/deployment/root-app Missing liveness probe
checkov /lab/broken/root-user.yaml:2-20
 Add a livenessProbe. checkov HIGH
−1.8
LOW TATAR-OPS-001
Operational Health		 production/deployment/latest-app Missing readiness probe
checkov /lab/broken/latest-tag.yaml:2-16
popeye container-xNo probes defined (popeye warning)
popeye pod/latest-app-598c4dc6b8-ldjqqrolled up to deployment/latest-app
 Add a readinessProbe. checkov • popeye HIGH
−1.8
LOW TATAR-OPS-001
Operational Health		 production/deployment/host-ns-app Missing readiness probe
checkov /lab/broken/host-namespaces.yaml:2-19
 Add a readinessProbe. checkov HIGH
−1.8
LOW TATAR-CON-010
Container Security		 production/deployment/latest-app Missing CPU/memory limits
checkov /lab/broken/latest-tag.yaml:2-16
popeye container-xNo resources requests/limits defined (popeye warning)
popeye pod/latest-app-598c4dc6b8-ldjqqrolled up to deployment/latest-app
 Set resources.limits.cpu and .memory. checkov • popeye HIGH
−1.8
LOW TATAR-OPS-005
Operational Health		 production/deployment/secret-env-app imagePullPolicy not set correctly
checkov /lab/broken/secret-env.yaml:2-21
 Set imagePullPolicy explicitly to IfNotPresent/Always. checkov HIGH
−1.8
LOW TATAR-CON-010
Container Security		 production/deployment/host-ns-app Missing CPU/memory limits
checkov /lab/broken/host-namespaces.yaml:2-19
 Set resources.limits.cpu and .memory. checkov HIGH
−1.8
LOW TATAR-OPS-001
Operational Health		 production/deployment/root-app Missing readiness probe
checkov /lab/broken/root-user.yaml:2-20
 Add a readinessProbe. checkov HIGH
−1.8
INFO TATAR-OPS-003
Operational Health		 production/service/orphan-svc Orphan / dead service (no endpoints)
popeye No pods match service selector (popeye warning)
 Delete the service or fix its selector. popeye HIGH
INFO TATAR-OPS-004
Operational Health		 production/configmap/unused-cm Unused ConfigMap / Secret
popeye Used? Unable to locate resource reference (popeye info)
 Delete the unused object. popeye HIGH