{ "schema_version": "1.0", "metadata": { "scan_id": "d7a05c0c3bb9044e10332eb0d63ee217", "cluster_name": "demo-prod", "scan_mode": "offline", "lang": "en", "tatar_version": "1.0.3", "scanner_versions": { "checkov": "3.2.10", "kubescape": "3.1.4", "popeye": "0.22.1", "trivy": "0.67.2" }, "scanner_runs": [ { "scanner": "trivy", "status": "ingested", "version": "0.67.2", "raw_bytes": 2954, "findings": 5 }, { "scanner": "kubescape", "status": "ingested", "version": "3.1.4", "raw_bytes": 1027, "findings": 3 }, { "scanner": "checkov", "status": "ingested", "version": "3.2.10", "raw_bytes": 41403, "findings": 89, "unmapped_rules": [ "CKV2_K8S_1", "CKV2_K8S_2", "CKV2_K8S_3", "CKV2_K8S_4", "CKV2_K8S_5", "CKV_K8S_30", "CKV_K8S_40", "CKV_K8S_42", "CKV_K8S_43" ], "unmapped_count": 19 }, { "scanner": "popeye", "status": "ingested", "version": "0.22.1", "raw_bytes": 1603, "findings": 6 } ], "rollup": { "moved": 3, "pods": [ "latest-app-598c4dc6b8-ldjqq" ] }, "started_at": "2026-09-27T11:21:49Z", "finished_at": "2026-09-27T11:21:49Z", "result_hash": "sha256:c887c5d96de4e6df3f92691840c967e212515219213f4f225e50f6862c597b6a", "inventory": { "ClusterRoles": 27, "Deployments": 31, "Ingresses": 6, "Namespaces": 8, "Nodes": 5, "Pods": 142, "Services": 54 } }, "summary": { "counts": { "CRITICAL": 2, "HIGH": 18, "INFO": 2, "LOW": 19, "MEDIUM": 34 }, "blind_shot": 0, "risk_score": 19, "risk_band": "Critical", "total_findings": 75, "risk_breakdown": { "total_penalty": 427.4, "high_penalty": 417.4, "low_penalty_raw": 34.2, "low_penalty_capped": 10, "low_pool_cap": 10, "scale": 100, "formula": "100 / (1 + P/K)", "top_contributors": [ { "id": "TK-9b701eb0482a", "canonical_control": "TATAR-IMG-001", "resource": "deployment/api", "severity": "CRITICAL", "contribution": 18, "share": 4 }, { "id": "TK-099acce09622", "canonical_control": "TATAR-CON-003", "resource": "deployment/root-app", "severity": "HIGH", "contribution": 12.6, "share": 2.8 }, { "id": "TK-136338cfcb62", "canonical_control": "TATAR-CON-004", "resource": "deployment/root-app", "severity": "HIGH", "contribution": 12.6, "share": 2.8 }, { "id": "TK-31cdabe90e87", "canonical_control": "TATAR-CON-001", "resource": "deployment/privileged-app", "severity": "HIGH", "contribution": 12.6, "share": 2.8 }, { "id": "TK-3d236fda3600", "canonical_control": "TATAR-CON-006", "resource": "deployment/host-ns-app", "severity": "HIGH", "contribution": 12.6, "share": 2.8 } ] } }, "findings": [ { "id": "TK-9b701eb0482a", "canonical_control": "TATAR-IMG-001", "resource": "deployment/api", "namespace": "production", "type": "vulnerability", "category": "Image Security", "severity": "CRITICAL", "original_severity": "CRITICAL", "title": "Critical CVE in container image", "description": "openssl critical flaw", "evidence": [ { "scanner": "trivy", "value": "fixed in 3.1.4", "detail": "openssl@3.1.0" } ], "remediation": "Update the base image/package or apply a patch.", "found_by": [ "trivy" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 18, "risk_factors": { "base_weight": 10, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 18 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "references": [ "CVE-2024-0001", "https://avd.aquasec.com/nvd/cve-2024-0001" ], "raw_refs": [ { "scanner": "trivy", "rule_id": "CVE-*" } ] }, { "id": "TK-951f02615a28", "canonical_control": "TATAR-RBAC-001", "resource": "clusterrolebinding/admin-bind", "type": "rbac", "category": "RBAC \u0026 Authorization", "severity": "CRITICAL", "original_severity": "CRITICAL", "title": "cluster-admin binding overuse", "description": "", "remediation": "Restrict cluster-admin; use specific scoped roles.", "found_by": [ "kubescape" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12, "risk_factors": { "base_weight": 10, "asset_context": 1, "exposure": 1, "confidence": 1.2, "contribution": 12 }, "attack": [ { "technique": "T1078", "name": "Valid Accounts", "tactic": "Privilege Escalation" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "kubescape", "rule_id": "C-0035" } ] }, { "id": "TK-099acce09622", "canonical_control": "TATAR-CON-003", "resource": "deployment/root-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "HIGH", "original_severity": "HIGH", "title": "Allow privilege escalation", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/root-user.yaml:2-20" } ], "remediation": "Set securityContext.allowPrivilegeEscalation=false.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "attack": [ { "technique": "T1611", "name": "Escape to Host", "tactic": "Privilege Escalation" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_20" } ] }, { "id": "TK-136338cfcb62", "canonical_control": "TATAR-CON-004", "resource": "deployment/root-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "HIGH", "original_severity": "HIGH", "title": "Dangerous capabilities added", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/root-user.yaml:2-20" } ], "remediation": "Drop unnecessary capabilities; start by dropping ALL.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_28" }, { "scanner": "checkov", "rule_id": "CKV_K8S_37" } ] }, { "id": "TK-31cdabe90e87", "canonical_control": "TATAR-CON-001", "resource": "deployment/privileged-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "HIGH", "original_severity": "HIGH", "title": "Privileged container enabled", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/privileged.yaml:2-18" } ], "remediation": "Set securityContext.privileged=false.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "attack": [ { "technique": "T1611", "name": "Escape to Host", "tactic": "Privilege Escalation" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_16" } ] }, { "id": "TK-3d236fda3600", "canonical_control": "TATAR-CON-006", "resource": "deployment/host-ns-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "HIGH", "original_severity": "HIGH", "title": "Host network enabled", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/host-namespaces.yaml:2-19" } ], "remediation": "Set hostNetwork=false.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "attack": [ { "technique": "T1611", "name": "Escape to Host", "tactic": "Privilege Escalation" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_19" } ] }, { "id": "TK-41b7549616ee", "canonical_control": "TATAR-IMG-002", "resource": "deployment/api", "namespace": "production", "type": "vulnerability", "category": "Image Security", "severity": "HIGH", "original_severity": "HIGH", "title": "High CVE in container image", "description": "libcurl high flaw", "evidence": [ { "scanner": "trivy", "value": "fixed in 8.1.2", "detail": "libcurl@8.1.0" } ], "remediation": "Update the base image/package.", "found_by": [ "trivy" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "references": [ "CVE-2024-0002", "https://avd.aquasec.com/nvd/cve-2024-0002" ], "raw_refs": [ { "scanner": "trivy", "rule_id": "CVE-*" } ] }, { "id": "TK-4aa9f9accec0", "canonical_control": "TATAR-CON-003", "resource": "deployment/latest-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "HIGH", "original_severity": "HIGH", "title": "Allow privilege escalation", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/latest-tag.yaml:2-16" } ], "remediation": "Set securityContext.allowPrivilegeEscalation=false.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "attack": [ { "technique": "T1611", "name": "Escape to Host", "tactic": "Privilege Escalation" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_20" } ] }, { "id": "TK-5704a8c54610", "canonical_control": "TATAR-CON-003", "resource": "deployment/privileged-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "HIGH", "original_severity": "HIGH", "title": "Allow privilege escalation", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/privileged.yaml:2-18" } ], "remediation": "Set securityContext.allowPrivilegeEscalation=false.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "attack": [ { "technique": "T1611", "name": "Escape to Host", "tactic": "Privilege Escalation" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_20" } ] }, { "id": "TK-57fde9b06751", "canonical_control": "TATAR-CON-004", "resource": "deployment/host-ns-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "HIGH", "original_severity": "HIGH", "title": "Dangerous capabilities added", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/host-namespaces.yaml:2-19" } ], "remediation": "Drop unnecessary capabilities; start by dropping ALL.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_28" }, { "scanner": "checkov", "rule_id": "CKV_K8S_37" } ] }, { "id": "TK-5f9218ba0467", "canonical_control": "TATAR-CON-004", "resource": "deployment/latest-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "HIGH", "original_severity": "HIGH", "title": "Dangerous capabilities added", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/latest-tag.yaml:2-16" } ], "remediation": "Drop unnecessary capabilities; start by dropping ALL.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_28" }, { "scanner": "checkov", "rule_id": "CKV_K8S_37" } ] }, { "id": "TK-68270b3a0306", "canonical_control": "TATAR-CON-003", "resource": "deployment/secret-env-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "HIGH", "original_severity": "HIGH", "title": "Allow privilege escalation", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/secret-env.yaml:2-21" } ], "remediation": "Set securityContext.allowPrivilegeEscalation=false.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "attack": [ { "technique": "T1611", "name": "Escape to Host", "tactic": "Privilege Escalation" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_20" } ] }, { "id": "TK-8d84b4a0664a", "canonical_control": "TATAR-CON-001", "resource": "deployment/api", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "HIGH", "original_severity": "HIGH", "title": "Privileged container enabled", "description": "Container running in privileged mode.", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/api.yaml:1-22" }, { "scanner": "trivy", "path": "spec.template.spec.containers[0].securityContext.privileged" } ], "remediation": "Set securityContext.privileged=false.", "found_by": [ "checkov", "kubescape", "trivy" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "attack": [ { "technique": "T1611", "name": "Escape to Host", "tactic": "Privilege Escalation" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "references": [ "https://avd.aquasec.com/misconfig/ksv017", "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-15" ], "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_16" }, { "scanner": "kubescape", "rule_id": "C-0057" }, { "scanner": "trivy", "rule_id": "AVD-KSV0017" } ] }, { "id": "TK-98dbfde1c7dd", "canonical_control": "TATAR-CON-003", "resource": "deployment/host-ns-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "HIGH", "original_severity": "HIGH", "title": "Allow privilege escalation", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/host-namespaces.yaml:2-19" } ], "remediation": "Set securityContext.allowPrivilegeEscalation=false.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "attack": [ { "technique": "T1611", "name": "Escape to Host", "tactic": "Privilege Escalation" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_20" } ] }, { "id": "TK-ace1a8e38c9b", "canonical_control": "TATAR-CON-005", "resource": "deployment/host-ns-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "HIGH", "original_severity": "HIGH", "title": "Host PID namespace shared", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/host-namespaces.yaml:2-19" } ], "remediation": "Set hostPID=false.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "attack": [ { "technique": "T1611", "name": "Escape to Host", "tactic": "Privilege Escalation" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_17" } ] }, { "id": "TK-b18b8be32e49", "canonical_control": "TATAR-CON-004", "resource": "deployment/privileged-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "HIGH", "original_severity": "HIGH", "title": "Dangerous capabilities added", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/privileged.yaml:2-18" } ], "remediation": "Drop unnecessary capabilities; start by dropping ALL.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_28" }, { "scanner": "checkov", "rule_id": "CKV_K8S_37" } ] }, { "id": "TK-d226ef48aa1d", "canonical_control": "TATAR-CON-004", "resource": "deployment/secret-env-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "HIGH", "original_severity": "HIGH", "title": "Dangerous capabilities added", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/secret-env.yaml:2-21" } ], "remediation": "Drop unnecessary capabilities; start by dropping ALL.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 12.6, "risk_factors": { "base_weight": 7, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 12.6 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_28" }, { "scanner": "checkov", "rule_id": "CKV_K8S_37" } ] }, { "id": "TK-63fbfb555a96", "canonical_control": "TATAR-SEC-001", "resource": "pod/worker", "namespace": "default", "type": "secret", "category": "Secret Management", "severity": "HIGH", "original_severity": "HIGH", "title": "Secret exposed in environment variable", "description": "Илэрсэн нууц: AWS", "evidence": [ { "scanner": "trivy", "detail": "env: AWS_ACCESS_KEY_ID=AKIA********" } ], "remediation": "Use Kubernetes Secrets with volume mounts.", "found_by": [ "trivy" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 8.4, "risk_factors": { "base_weight": 7, "asset_context": 1, "exposure": 1, "confidence": 1.2, "contribution": 8.4 }, "attack": [ { "technique": "T1552.007", "name": "Unsecured Credentials: Container API", "tactic": "Credential Access" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "trivy", "rule_id": "secret" } ] }, { "id": "TK-9716b35d5c9f", "canonical_control": "TATAR-RBAC-002", "resource": "clusterrole/too-powerful", "namespace": "default", "type": "rbac", "category": "RBAC \u0026 Authorization", "severity": "HIGH", "original_severity": "HIGH", "title": "Wildcard permissions in role", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/wildcard-rbac.yaml:2-10" } ], "remediation": "Narrow permissions to specific resources/verbs.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 8.4, "risk_factors": { "base_weight": 7, "asset_context": 1, "exposure": 1, "confidence": 1.2, "contribution": 8.4 }, "attack": [ { "technique": "T1078", "name": "Valid Accounts", "tactic": "Privilege Escalation" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_49" } ] }, { "id": "TK-13f175cd7fcc", "canonical_control": "TATAR-RBAC-003", "resource": "clusterrole/too-powerful", "namespace": "default", "type": "rbac", "category": "RBAC \u0026 Authorization", "severity": "HIGH", "original_severity": "HIGH", "title": "Excessive / risky permissions", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/wildcard-rbac.yaml:2-10" } ], "remediation": "Clean up permissions using least-privilege.", "found_by": [ "checkov" ], "confidence": "MEDIUM", "blind_shot": false, "risk_contribution": 7, "risk_factors": { "base_weight": 7, "asset_context": 1, "exposure": 1, "confidence": 1, "contribution": 7 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_155" }, { "scanner": "checkov", "rule_id": "CKV_K8S_156" }, { "scanner": "checkov", "rule_id": "CKV_K8S_157" }, { "scanner": "checkov", "rule_id": "CKV_K8S_158" } ] }, { "id": "TK-082fb33745e9", "canonical_control": "TATAR-CON-009", "resource": "deployment/privileged-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Read-only root filesystem disabled", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/privileged.yaml:2-18" } ], "remediation": "Set securityContext.readOnlyRootFilesystem=true.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_22" } ] }, { "id": "TK-13b2dd676317", "canonical_control": "TATAR-CON-008", "resource": "deployment/privileged-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Missing securityContext", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/privileged.yaml:2-18" } ], "remediation": "Add a securityContext block with hardening settings.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_29" } ] }, { "id": "TK-1de41f3015aa", "canonical_control": "TATAR-CON-008", "resource": "deployment/host-ns-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Missing securityContext", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/host-namespaces.yaml:2-19" } ], "remediation": "Add a securityContext block with hardening settings.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_29" } ] }, { "id": "TK-2681ba7df61b", "canonical_control": "TATAR-SEC-003", "resource": "deployment/latest-app", "namespace": "production", "type": "secret", "category": "Secret Management", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Service account token auto-mounted", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/latest-tag.yaml:2-16" } ], "remediation": "Set automountServiceAccountToken=false.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "attack": [ { "technique": "T1528", "name": "Steal Application Access Token", "tactic": "Credential Access" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_38" } ] }, { "id": "TK-2a5ed40b070f", "canonical_control": "TATAR-SEC-003", "resource": "deployment/host-ns-app", "namespace": "production", "type": "secret", "category": "Secret Management", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Service account token auto-mounted", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/host-namespaces.yaml:2-19" } ], "remediation": "Set automountServiceAccountToken=false.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "attack": [ { "technique": "T1528", "name": "Steal Application Access Token", "tactic": "Credential Access" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_38" } ] }, { "id": "TK-49fd10bac73f", "canonical_control": "TATAR-CON-008", "resource": "deployment/latest-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Missing securityContext", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/latest-tag.yaml:2-16" } ], "remediation": "Add a securityContext block with hardening settings.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_29" } ] }, { "id": "TK-516c6d9edcb3", "canonical_control": "TATAR-CON-009", "resource": "deployment/latest-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Read-only root filesystem disabled", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/latest-tag.yaml:2-16" } ], "remediation": "Set securityContext.readOnlyRootFilesystem=true.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_22" } ] }, { "id": "TK-6beef8a54dc8", "canonical_control": "TATAR-CON-009", "resource": "deployment/secret-env-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Read-only root filesystem disabled", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/secret-env.yaml:2-21" } ], "remediation": "Set securityContext.readOnlyRootFilesystem=true.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_22" } ] }, { "id": "TK-7195633ad1e7", "canonical_control": "TATAR-CON-011", "resource": "deployment/privileged-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Default seccomp profile not set", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/privileged.yaml:2-18" } ], "remediation": "Set seccompProfile.type=RuntimeDefault.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_31" } ] }, { "id": "TK-7be77a7df53a", "canonical_control": "TATAR-CON-002", "resource": "deployment/privileged-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Container running as root", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/privileged.yaml:2-18" } ], "remediation": "Set securityContext.runAsNonRoot=true.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_23" } ] }, { "id": "TK-7e89d41311ae", "canonical_control": "TATAR-CON-009", "resource": "deployment/root-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Read-only root filesystem disabled", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/root-user.yaml:2-20" } ], "remediation": "Set securityContext.readOnlyRootFilesystem=true.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_22" } ] }, { "id": "TK-814cb7a3c114", "canonical_control": "TATAR-CON-002", "resource": "deployment/host-ns-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Container running as root", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/host-namespaces.yaml:2-19" } ], "remediation": "Set securityContext.runAsNonRoot=true.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_23" } ] }, { "id": "TK-839459326531", "canonical_control": "TATAR-CON-011", "resource": "deployment/latest-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Default seccomp profile not set", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/latest-tag.yaml:2-16" } ], "remediation": "Set seccompProfile.type=RuntimeDefault.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_31" } ] }, { "id": "TK-87988c74ef05", "canonical_control": "TATAR-CON-002", "resource": "deployment/root-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Container running as root", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/root-user.yaml:2-20" } ], "remediation": "Set securityContext.runAsNonRoot=true.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_23" } ] }, { "id": "TK-8b4244f9cf41", "canonical_control": "TATAR-CON-002", "resource": "deployment/api", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Container running as root", "description": "Container runs as root.", "evidence": [ { "scanner": "trivy", "path": "spec.template.spec.containers[0].securityContext.runAsNonRoot" } ], "remediation": "Set securityContext.runAsNonRoot=true.", "found_by": [ "trivy" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "trivy", "rule_id": "AVD-KSV0012" } ] }, { "id": "TK-8ee9dfe4dcc7", "canonical_control": "TATAR-CON-011", "resource": "deployment/secret-env-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Default seccomp profile not set", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/secret-env.yaml:2-21" } ], "remediation": "Set seccompProfile.type=RuntimeDefault.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_31" } ] }, { "id": "TK-a5de8cd35166", "canonical_control": "TATAR-IMG-003", "resource": "deployment/latest-app", "namespace": "production", "type": "misconfiguration", "category": "Image Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Image uses :latest tag", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/latest-tag.yaml:2-16" }, { "scanner": "popeye", "path": "container-x", "value": "popeye warning", "detail": "Image tagged \"latest\" in use" }, { "scanner": "popeye", "path": "pod/latest-app-598c4dc6b8-ldjqq", "detail": "rolled up to deployment/latest-app" } ], "remediation": "Use a specific version (digest/tag).", "found_by": [ "checkov", "popeye" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "attack": [ { "technique": "T1525", "name": "Implant Internal Image", "tactic": "Persistence" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_14" }, { "scanner": "popeye", "rule_id": "POP-101" } ] }, { "id": "TK-a8737652d0ce", "canonical_control": "TATAR-SEC-003", "resource": "deployment/root-app", "namespace": "production", "type": "secret", "category": "Secret Management", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Service account token auto-mounted", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/root-user.yaml:2-20" } ], "remediation": "Set automountServiceAccountToken=false.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "attack": [ { "technique": "T1528", "name": "Steal Application Access Token", "tactic": "Credential Access" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_38" } ] }, { "id": "TK-a9ae78ef5560", "canonical_control": "TATAR-CON-011", "resource": "deployment/host-ns-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Default seccomp profile not set", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/host-namespaces.yaml:2-19" } ], "remediation": "Set seccompProfile.type=RuntimeDefault.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_31" } ] }, { "id": "TK-adafa3db6d93", "canonical_control": "TATAR-CON-008", "resource": "deployment/secret-env-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Missing securityContext", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/secret-env.yaml:2-21" } ], "remediation": "Add a securityContext block with hardening settings.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_29" } ] }, { "id": "TK-b856db0d7963", "canonical_control": "TATAR-SEC-003", "resource": "deployment/privileged-app", "namespace": "production", "type": "secret", "category": "Secret Management", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Service account token auto-mounted", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/privileged.yaml:2-18" } ], "remediation": "Set automountServiceAccountToken=false.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "attack": [ { "technique": "T1528", "name": "Steal Application Access Token", "tactic": "Credential Access" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_38" } ] }, { "id": "TK-bb3bbf42d8cd", "canonical_control": "TATAR-NET-001", "resource": "deployment/api", "namespace": "production", "type": "network", "category": "Network Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Missing NetworkPolicy", "description": "", "remediation": "Define a NetworkPolicy for each namespace.", "found_by": [ "kubescape" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "attack": [ { "technique": "T1046", "name": "Network Service Discovery", "tactic": "Discovery" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "kubescape", "rule_id": "C-0260" } ] }, { "id": "TK-bd2b145c543d", "canonical_control": "TATAR-CON-011", "resource": "deployment/root-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Default seccomp profile not set", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/root-user.yaml:2-20" } ], "remediation": "Set seccompProfile.type=RuntimeDefault.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_31" } ] }, { "id": "TK-c9d2c4a5f566", "canonical_control": "TATAR-CON-008", "resource": "deployment/root-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Missing securityContext", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/root-user.yaml:2-20" } ], "remediation": "Add a securityContext block with hardening settings.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_29" } ] }, { "id": "TK-ca93aca05b29", "canonical_control": "TATAR-CON-009", "resource": "deployment/host-ns-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Read-only root filesystem disabled", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/host-namespaces.yaml:2-19" } ], "remediation": "Set securityContext.readOnlyRootFilesystem=true.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_22" } ] }, { "id": "TK-d3601d8c9f44", "canonical_control": "TATAR-CON-002", "resource": "deployment/latest-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Container running as root", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/latest-tag.yaml:2-16" } ], "remediation": "Set securityContext.runAsNonRoot=true.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_23" } ] }, { "id": "TK-deeec93fcca3", "canonical_control": "TATAR-SEC-003", "resource": "deployment/secret-env-app", "namespace": "production", "type": "secret", "category": "Secret Management", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Service account token auto-mounted", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/secret-env.yaml:2-21" } ], "remediation": "Set automountServiceAccountToken=false.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "attack": [ { "technique": "T1528", "name": "Steal Application Access Token", "tactic": "Credential Access" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_38" } ] }, { "id": "TK-e22e1d586ba2", "canonical_control": "TATAR-RBAC-005", "resource": "pod/latest-app-598c4dc6b8-ldjqq", "namespace": "production", "type": "rbac", "category": "RBAC \u0026 Authorization", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Default service account in use", "description": "", "evidence": [ { "scanner": "popeye", "value": "popeye warning", "detail": "Uses \"default\" ServiceAccount" } ], "remediation": "Create a dedicated least-privilege SA per workload.", "found_by": [ "popeye" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "popeye", "rule_id": "POP-300" } ] }, { "id": "TK-ee582c898d28", "canonical_control": "TATAR-CON-002", "resource": "deployment/secret-env-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Container running as root", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/secret-env.yaml:2-21" } ], "remediation": "Set securityContext.runAsNonRoot=true.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 5.4, "risk_factors": { "base_weight": 3, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 5.4 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_23" } ] }, { "id": "TK-274cae99f523", "canonical_control": "TATAR-NET-001", "resource": "pod/app-latest-app", "type": "network", "category": "Network Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Missing NetworkPolicy", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/latest-tag.yaml:2-16" } ], "remediation": "Define a NetworkPolicy for each namespace.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 3.6, "risk_factors": { "base_weight": 3, "asset_context": 1, "exposure": 1, "confidence": 1.2, "contribution": 3.6 }, "attack": [ { "technique": "T1046", "name": "Network Service Discovery", "tactic": "Discovery" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV2_K8S_6" } ] }, { "id": "TK-30d71de77ed3", "canonical_control": "TATAR-NET-001", "resource": "pod/app-root-app", "type": "network", "category": "Network Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Missing NetworkPolicy", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/root-user.yaml:2-20" } ], "remediation": "Define a NetworkPolicy for each namespace.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 3.6, "risk_factors": { "base_weight": 3, "asset_context": 1, "exposure": 1, "confidence": 1.2, "contribution": 3.6 }, "attack": [ { "technique": "T1046", "name": "Network Service Discovery", "tactic": "Discovery" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV2_K8S_6" } ] }, { "id": "TK-945b588f85be", "canonical_control": "TATAR-NET-001", "resource": "pod/app-privileged-app", "type": "network", "category": "Network Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Missing NetworkPolicy", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/privileged.yaml:2-18" } ], "remediation": "Define a NetworkPolicy for each namespace.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 3.6, "risk_factors": { "base_weight": 3, "asset_context": 1, "exposure": 1, "confidence": 1.2, "contribution": 3.6 }, "attack": [ { "technique": "T1046", "name": "Network Service Discovery", "tactic": "Discovery" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV2_K8S_6" } ] }, { "id": "TK-a45df52da489", "canonical_control": "TATAR-NET-001", "resource": "pod/app-secret-env-app", "type": "network", "category": "Network Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Missing NetworkPolicy", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/secret-env.yaml:2-21" } ], "remediation": "Define a NetworkPolicy for each namespace.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 3.6, "risk_factors": { "base_weight": 3, "asset_context": 1, "exposure": 1, "confidence": 1.2, "contribution": 3.6 }, "attack": [ { "technique": "T1046", "name": "Network Service Discovery", "tactic": "Discovery" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV2_K8S_6" } ] }, { "id": "TK-ba5a2bd17401", "canonical_control": "TATAR-NET-001", "resource": "pod/app-host-ns-app", "type": "network", "category": "Network Security", "severity": "MEDIUM", "original_severity": "MEDIUM", "title": "Missing NetworkPolicy", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/host-namespaces.yaml:2-19" } ], "remediation": "Define a NetworkPolicy for each namespace.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 3.6, "risk_factors": { "base_weight": 3, "asset_context": 1, "exposure": 1, "confidence": 1.2, "contribution": 3.6 }, "attack": [ { "technique": "T1046", "name": "Network Service Discovery", "tactic": "Discovery" } ], "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV2_K8S_6" } ] }, { "id": "TK-038d0c5df290", "canonical_control": "TATAR-OPS-005", "resource": "deployment/root-app", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "LOW", "original_severity": "LOW", "title": "imagePullPolicy not set correctly", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/root-user.yaml:2-20" } ], "remediation": "Set imagePullPolicy explicitly to IfNotPresent/Always.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_15" } ] }, { "id": "TK-074f58bfc052", "canonical_control": "TATAR-CON-010", "resource": "deployment/secret-env-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "LOW", "original_severity": "LOW", "title": "Missing CPU/memory limits", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/secret-env.yaml:2-21" } ], "remediation": "Set resources.limits.cpu and .memory.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_10" }, { "scanner": "checkov", "rule_id": "CKV_K8S_11" }, { "scanner": "checkov", "rule_id": "CKV_K8S_12" }, { "scanner": "checkov", "rule_id": "CKV_K8S_13" } ] }, { "id": "TK-0ae0b98d93ee", "canonical_control": "TATAR-OPS-002", "resource": "deployment/host-ns-app", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "LOW", "original_severity": "LOW", "title": "Missing liveness probe", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/host-namespaces.yaml:2-19" } ], "remediation": "Add a livenessProbe.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_8" } ] }, { "id": "TK-18ab67dd3f54", "canonical_control": "TATAR-OPS-001", "resource": "deployment/secret-env-app", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "LOW", "original_severity": "LOW", "title": "Missing readiness probe", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/secret-env.yaml:2-21" } ], "remediation": "Add a readinessProbe.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_9" } ] }, { "id": "TK-237bab83414e", "canonical_control": "TATAR-OPS-002", "resource": "deployment/secret-env-app", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "LOW", "original_severity": "LOW", "title": "Missing liveness probe", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/secret-env.yaml:2-21" } ], "remediation": "Add a livenessProbe.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_8" } ] }, { "id": "TK-2b7f656a9095", "canonical_control": "TATAR-OPS-001", "resource": "deployment/privileged-app", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "LOW", "original_severity": "LOW", "title": "Missing readiness probe", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/privileged.yaml:2-18" } ], "remediation": "Add a readinessProbe.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_9" } ] }, { "id": "TK-692c88e9019b", "canonical_control": "TATAR-OPS-005", "resource": "deployment/privileged-app", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "LOW", "original_severity": "LOW", "title": "imagePullPolicy not set correctly", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/privileged.yaml:2-18" } ], "remediation": "Set imagePullPolicy explicitly to IfNotPresent/Always.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_15" } ] }, { "id": "TK-721ece12b07e", "canonical_control": "TATAR-CON-010", "resource": "deployment/privileged-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "LOW", "original_severity": "LOW", "title": "Missing CPU/memory limits", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/privileged.yaml:2-18" } ], "remediation": "Set resources.limits.cpu and .memory.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_10" }, { "scanner": "checkov", "rule_id": "CKV_K8S_11" }, { "scanner": "checkov", "rule_id": "CKV_K8S_12" }, { "scanner": "checkov", "rule_id": "CKV_K8S_13" } ] }, { "id": "TK-74c9df40c60c", "canonical_control": "TATAR-OPS-002", "resource": "deployment/privileged-app", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "LOW", "original_severity": "LOW", "title": "Missing liveness probe", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/privileged.yaml:2-18" } ], "remediation": "Add a livenessProbe.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_8" } ] }, { "id": "TK-9ee9a819ee98", "canonical_control": "TATAR-CON-010", "resource": "deployment/root-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "LOW", "original_severity": "LOW", "title": "Missing CPU/memory limits", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/root-user.yaml:2-20" } ], "remediation": "Set resources.limits.cpu and .memory.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_10" }, { "scanner": "checkov", "rule_id": "CKV_K8S_11" }, { "scanner": "checkov", "rule_id": "CKV_K8S_12" }, { "scanner": "checkov", "rule_id": "CKV_K8S_13" } ] }, { "id": "TK-ae88c4a249fc", "canonical_control": "TATAR-OPS-005", "resource": "deployment/host-ns-app", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "LOW", "original_severity": "LOW", "title": "imagePullPolicy not set correctly", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/host-namespaces.yaml:2-19" } ], "remediation": "Set imagePullPolicy explicitly to IfNotPresent/Always.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_15" } ] }, { "id": "TK-af8897bfd471", "canonical_control": "TATAR-OPS-002", "resource": "deployment/latest-app", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "LOW", "original_severity": "LOW", "title": "Missing liveness probe", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/latest-tag.yaml:2-16" } ], "remediation": "Add a livenessProbe.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_8" } ] }, { "id": "TK-b37a3556a105", "canonical_control": "TATAR-OPS-002", "resource": "deployment/root-app", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "LOW", "original_severity": "LOW", "title": "Missing liveness probe", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/root-user.yaml:2-20" } ], "remediation": "Add a livenessProbe.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_8" } ] }, { "id": "TK-c4c3a4ebaadc", "canonical_control": "TATAR-OPS-001", "resource": "deployment/latest-app", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "LOW", "original_severity": "LOW", "title": "Missing readiness probe", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/latest-tag.yaml:2-16" }, { "scanner": "popeye", "path": "container-x", "value": "popeye warning", "detail": "No probes defined" }, { "scanner": "popeye", "path": "pod/latest-app-598c4dc6b8-ldjqq", "detail": "rolled up to deployment/latest-app" } ], "remediation": "Add a readinessProbe.", "found_by": [ "checkov", "popeye" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_9" }, { "scanner": "popeye", "rule_id": "POP-102" } ] }, { "id": "TK-d677b8052956", "canonical_control": "TATAR-OPS-001", "resource": "deployment/host-ns-app", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "LOW", "original_severity": "LOW", "title": "Missing readiness probe", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/host-namespaces.yaml:2-19" } ], "remediation": "Add a readinessProbe.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_9" } ] }, { "id": "TK-d83cf4dbcadb", "canonical_control": "TATAR-CON-010", "resource": "deployment/latest-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "LOW", "original_severity": "LOW", "title": "Missing CPU/memory limits", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/latest-tag.yaml:2-16" }, { "scanner": "popeye", "path": "container-x", "value": "popeye warning", "detail": "No resources requests/limits defined" }, { "scanner": "popeye", "path": "pod/latest-app-598c4dc6b8-ldjqq", "detail": "rolled up to deployment/latest-app" } ], "remediation": "Set resources.limits.cpu and .memory.", "found_by": [ "checkov", "popeye" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_10" }, { "scanner": "checkov", "rule_id": "CKV_K8S_11" }, { "scanner": "checkov", "rule_id": "CKV_K8S_12" }, { "scanner": "checkov", "rule_id": "CKV_K8S_13" }, { "scanner": "popeye", "rule_id": "POP-106" } ] }, { "id": "TK-e424554e66b4", "canonical_control": "TATAR-OPS-005", "resource": "deployment/secret-env-app", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "LOW", "original_severity": "LOW", "title": "imagePullPolicy not set correctly", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/secret-env.yaml:2-21" } ], "remediation": "Set imagePullPolicy explicitly to IfNotPresent/Always.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_15" } ] }, { "id": "TK-e674e784efe2", "canonical_control": "TATAR-CON-010", "resource": "deployment/host-ns-app", "namespace": "production", "type": "misconfiguration", "category": "Container Security", "severity": "LOW", "original_severity": "LOW", "title": "Missing CPU/memory limits", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/host-namespaces.yaml:2-19" } ], "remediation": "Set resources.limits.cpu and .memory.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_10" }, { "scanner": "checkov", "rule_id": "CKV_K8S_11" }, { "scanner": "checkov", "rule_id": "CKV_K8S_12" }, { "scanner": "checkov", "rule_id": "CKV_K8S_13" } ] }, { "id": "TK-f46eb13ab024", "canonical_control": "TATAR-OPS-001", "resource": "deployment/root-app", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "LOW", "original_severity": "LOW", "title": "Missing readiness probe", "description": "", "evidence": [ { "scanner": "checkov", "path": "/lab/broken/root-user.yaml:2-20" } ], "remediation": "Add a readinessProbe.", "found_by": [ "checkov" ], "confidence": "HIGH", "blind_shot": false, "risk_contribution": 1.8, "risk_factors": { "base_weight": 1, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 1.8 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "checkov", "rule_id": "CKV_K8S_9" } ] }, { "id": "TK-45802dee62f8", "canonical_control": "TATAR-OPS-003", "resource": "service/orphan-svc", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "INFO", "original_severity": "INFO", "title": "Orphan / dead service (no endpoints)", "description": "", "evidence": [ { "scanner": "popeye", "value": "popeye warning", "detail": "No pods match service selector" } ], "remediation": "Delete the service or fix its selector.", "found_by": [ "popeye" ], "confidence": "HIGH", "blind_shot": false, "risk_factors": { "base_weight": 0, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 0 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "popeye", "rule_id": "POP-1100" } ] }, { "id": "TK-497ef288eeed", "canonical_control": "TATAR-OPS-004", "resource": "configmap/unused-cm", "namespace": "production", "type": "hygiene", "category": "Operational Health", "severity": "INFO", "original_severity": "INFO", "title": "Unused ConfigMap / Secret", "description": "", "evidence": [ { "scanner": "popeye", "value": "popeye info", "detail": "Used? Unable to locate resource reference" } ], "remediation": "Delete the unused object.", "found_by": [ "popeye" ], "confidence": "HIGH", "blind_shot": false, "risk_factors": { "base_weight": 0, "asset_context": 1.5, "exposure": 1, "confidence": 1.2, "contribution": 0 }, "status": "OPEN", "first_seen": "2026-09-27T11:21:49Z", "last_seen": "2026-09-27T11:21:49Z", "raw_refs": [ { "scanner": "popeye", "rule_id": "POP-400" } ] } ] }