{ "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "TATAR-Kuber", "version": "1.0.3", "informationUri": "https://github.com/ochmunkh/tatar-kuber", "rules": [ { "id": "TATAR-IMG-001", "name": "Critical CVE in container image", "shortDescription": { "text": "Critical CVE in container image" }, "properties": { "category": "Image Security", "security-severity": "9.5" } }, { "id": "TATAR-RBAC-001", "name": "cluster-admin binding overuse", "shortDescription": { "text": "cluster-admin binding overuse" }, "properties": { "category": "RBAC \u0026 Authorization", "security-severity": "9.5" } }, { "id": "TATAR-CON-003", "name": "Allow privilege escalation", "shortDescription": { "text": "Allow privilege escalation" }, "properties": { "category": "Container Security", "security-severity": "8.0" } }, { "id": "TATAR-CON-004", "name": "Dangerous capabilities added", "shortDescription": { "text": "Dangerous capabilities added" }, "properties": { "category": "Container Security", "security-severity": "8.0" } }, { "id": "TATAR-CON-001", "name": "Privileged container enabled", "shortDescription": { "text": "Privileged container enabled" }, "properties": { "category": "Container Security", "security-severity": "8.0" } }, { "id": "TATAR-CON-006", "name": "Host network enabled", "shortDescription": { "text": "Host network enabled" }, "properties": { "category": "Container Security", "security-severity": "8.0" } }, { "id": "TATAR-IMG-002", "name": "High CVE in container image", "shortDescription": { "text": "High CVE in container image" }, "properties": { "category": "Image Security", "security-severity": "8.0" } }, { "id": "TATAR-CON-005", "name": "Host PID namespace shared", "shortDescription": { "text": "Host PID namespace shared" }, "properties": { "category": "Container Security", "security-severity": "8.0" } }, { "id": "TATAR-SEC-001", "name": "Secret exposed in environment variable", "shortDescription": { "text": "Secret exposed in environment variable" }, "properties": { "category": "Secret Management", "security-severity": "8.0" } }, { "id": "TATAR-RBAC-002", "name": "Wildcard permissions in role", "shortDescription": { "text": "Wildcard permissions in role" }, "properties": { "category": "RBAC \u0026 Authorization", "security-severity": "8.0" } }, { "id": "TATAR-RBAC-003", "name": "Excessive / risky permissions", "shortDescription": { "text": "Excessive / risky permissions" }, "properties": { "category": "RBAC \u0026 Authorization", "security-severity": "8.0" } }, { "id": "TATAR-CON-009", "name": "Read-only root filesystem disabled", "shortDescription": { "text": "Read-only root filesystem disabled" }, "properties": { "category": "Container Security", "security-severity": "5.0" } }, { "id": "TATAR-CON-008", "name": "Missing securityContext", "shortDescription": { "text": "Missing securityContext" }, "properties": { "category": "Container Security", "security-severity": "5.0" } }, { "id": "TATAR-SEC-003", "name": "Service account token auto-mounted", "shortDescription": { "text": "Service account token auto-mounted" }, "properties": { "category": "Secret Management", "security-severity": "5.0" } }, { "id": "TATAR-CON-011", "name": "Default seccomp profile not set", "shortDescription": { "text": "Default seccomp profile not set" }, "properties": { "category": "Container Security", "security-severity": "5.0" } }, { "id": "TATAR-CON-002", "name": "Container running as root", "shortDescription": { "text": "Container running as root" }, "properties": { "category": "Container Security", "security-severity": "5.0" } }, { "id": "TATAR-IMG-003", "name": "Image uses :latest tag", "shortDescription": { "text": "Image uses :latest tag" }, "properties": { "category": "Image Security", "security-severity": "5.0" } }, { "id": "TATAR-NET-001", "name": "Missing NetworkPolicy", "shortDescription": { "text": "Missing NetworkPolicy" }, "properties": { "category": "Network Security", "security-severity": "5.0" } }, { "id": "TATAR-RBAC-005", "name": "Default service account in use", "shortDescription": { "text": "Default service account in use" }, "properties": { "category": "RBAC \u0026 Authorization", "security-severity": "5.0" } }, { "id": "TATAR-OPS-005", "name": "imagePullPolicy not set correctly", "shortDescription": { "text": "imagePullPolicy not set correctly" }, "properties": { "category": "Operational Health", "security-severity": "3.0" } }, { "id": "TATAR-CON-010", "name": "Missing CPU/memory limits", "shortDescription": { "text": "Missing CPU/memory limits" }, "properties": { "category": "Container Security", "security-severity": "3.0" } }, { "id": "TATAR-OPS-002", "name": "Missing liveness probe", "shortDescription": { "text": "Missing liveness probe" }, "properties": { "category": "Operational Health", "security-severity": "3.0" } }, { "id": "TATAR-OPS-001", "name": "Missing readiness probe", "shortDescription": { "text": "Missing readiness probe" }, "properties": { "category": "Operational Health", "security-severity": "3.0" } }, { "id": "TATAR-OPS-003", "name": "Orphan / dead service (no endpoints)", "shortDescription": { "text": "Orphan / dead service (no endpoints)" }, "properties": { "category": "Operational Health", "security-severity": "0.0" } }, { "id": "TATAR-OPS-004", "name": "Unused ConfigMap / Secret", "shortDescription": { "text": "Unused ConfigMap / Secret" }, "properties": { "category": "Operational Health", "security-severity": "0.0" } } ] } }, "results": [ { "ruleId": "TATAR-IMG-001", "level": "error", "message": { "text": "Critical CVE in container image — Update the base image/package or apply a patch." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "production/deployment/api" } } } ], "partialFingerprints": { "tatarId/v1": "TK-9b701eb0482a" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "trivy" ], "tatar_id": "TK-9b701eb0482a" } }, { "ruleId": "TATAR-RBAC-001", "level": "error", "message": { "text": "cluster-admin binding overuse — Restrict cluster-admin; use specific scoped roles." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "clusterrolebinding/admin-bind" } } } ], "partialFingerprints": { "tatarId/v1": "TK-951f02615a28" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "kubescape" ], "tatar_id": "TK-951f02615a28" } }, { "ruleId": "TATAR-CON-003", "level": "error", "message": { "text": "Allow privilege escalation — Set securityContext.allowPrivilegeEscalation=false." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/root-user.yaml" }, "region": { "startLine": 2, "endLine": 20 } } } ], "partialFingerprints": { "tatarId/v1": "TK-099acce09622" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-099acce09622" } }, { "ruleId": "TATAR-CON-004", "level": "error", "message": { "text": "Dangerous capabilities added — Drop unnecessary capabilities; start by dropping ALL." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/root-user.yaml" }, "region": { "startLine": 2, "endLine": 20 } } } ], "partialFingerprints": { "tatarId/v1": "TK-136338cfcb62" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-136338cfcb62" } }, { "ruleId": "TATAR-CON-001", "level": "error", "message": { "text": "Privileged container enabled — Set securityContext.privileged=false." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/privileged.yaml" }, "region": { "startLine": 2, "endLine": 18 } } } ], "partialFingerprints": { "tatarId/v1": "TK-31cdabe90e87" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-31cdabe90e87" } }, { "ruleId": "TATAR-CON-006", "level": "error", "message": { "text": "Host network enabled — Set hostNetwork=false." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/host-namespaces.yaml" }, "region": { "startLine": 2, "endLine": 19 } } } ], "partialFingerprints": { "tatarId/v1": "TK-3d236fda3600" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-3d236fda3600" } }, { "ruleId": "TATAR-IMG-002", "level": "error", "message": { "text": "High CVE in container image — Update the base image/package." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "production/deployment/api" } } } ], "partialFingerprints": { "tatarId/v1": "TK-41b7549616ee" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "trivy" ], "tatar_id": "TK-41b7549616ee" } }, { "ruleId": "TATAR-CON-003", "level": "error", "message": { "text": "Allow privilege escalation — Set securityContext.allowPrivilegeEscalation=false." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/latest-tag.yaml" }, "region": { "startLine": 2, "endLine": 16 } } } ], "partialFingerprints": { "tatarId/v1": "TK-4aa9f9accec0" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-4aa9f9accec0" } }, { "ruleId": "TATAR-CON-003", "level": "error", "message": { "text": "Allow privilege escalation — Set securityContext.allowPrivilegeEscalation=false." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/privileged.yaml" }, "region": { "startLine": 2, "endLine": 18 } } } ], "partialFingerprints": { "tatarId/v1": "TK-5704a8c54610" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-5704a8c54610" } }, { "ruleId": "TATAR-CON-004", "level": "error", "message": { "text": "Dangerous capabilities added — Drop unnecessary capabilities; start by dropping ALL." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/host-namespaces.yaml" }, "region": { "startLine": 2, "endLine": 19 } } } ], "partialFingerprints": { "tatarId/v1": "TK-57fde9b06751" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-57fde9b06751" } }, { "ruleId": "TATAR-CON-004", "level": "error", "message": { "text": "Dangerous capabilities added — Drop unnecessary capabilities; start by dropping ALL." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/latest-tag.yaml" }, "region": { "startLine": 2, "endLine": 16 } } } ], "partialFingerprints": { "tatarId/v1": "TK-5f9218ba0467" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-5f9218ba0467" } }, { "ruleId": "TATAR-CON-003", "level": "error", "message": { "text": "Allow privilege escalation — Set securityContext.allowPrivilegeEscalation=false." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/secret-env.yaml" }, "region": { "startLine": 2, "endLine": 21 } } } ], "partialFingerprints": { "tatarId/v1": "TK-68270b3a0306" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-68270b3a0306" } }, { "ruleId": "TATAR-CON-001", "level": "error", "message": { "text": "Privileged container enabled — Set securityContext.privileged=false." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/api.yaml" }, "region": { "startLine": 1, "endLine": 22 } } } ], "partialFingerprints": { "tatarId/v1": "TK-8d84b4a0664a" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov", "kubescape", "trivy" ], "tatar_id": "TK-8d84b4a0664a" } }, { "ruleId": "TATAR-CON-003", "level": "error", "message": { "text": "Allow privilege escalation — Set securityContext.allowPrivilegeEscalation=false." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/host-namespaces.yaml" }, "region": { "startLine": 2, "endLine": 19 } } } ], "partialFingerprints": { "tatarId/v1": "TK-98dbfde1c7dd" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-98dbfde1c7dd" } }, { "ruleId": "TATAR-CON-005", "level": "error", "message": { "text": "Host PID namespace shared — Set hostPID=false." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/host-namespaces.yaml" }, "region": { "startLine": 2, "endLine": 19 } } } ], "partialFingerprints": { "tatarId/v1": "TK-ace1a8e38c9b" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-ace1a8e38c9b" } }, { "ruleId": "TATAR-CON-004", "level": "error", "message": { "text": "Dangerous capabilities added — Drop unnecessary capabilities; start by dropping ALL." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/privileged.yaml" }, "region": { "startLine": 2, "endLine": 18 } } } ], "partialFingerprints": { "tatarId/v1": "TK-b18b8be32e49" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-b18b8be32e49" } }, { "ruleId": "TATAR-CON-004", "level": "error", "message": { "text": "Dangerous capabilities added — Drop unnecessary capabilities; start by dropping ALL." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/secret-env.yaml" }, "region": { "startLine": 2, "endLine": 21 } } } ], "partialFingerprints": { "tatarId/v1": "TK-d226ef48aa1d" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-d226ef48aa1d" } }, { "ruleId": "TATAR-SEC-001", "level": "error", "message": { "text": "Secret exposed in environment variable — Use Kubernetes Secrets with volume mounts." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "default/pod/worker" } } } ], "partialFingerprints": { "tatarId/v1": "TK-63fbfb555a96" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "trivy" ], "tatar_id": "TK-63fbfb555a96" } }, { "ruleId": "TATAR-RBAC-002", "level": "error", "message": { "text": "Wildcard permissions in role — Narrow permissions to specific resources/verbs." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/wildcard-rbac.yaml" }, "region": { "startLine": 2, "endLine": 10 } } } ], "partialFingerprints": { "tatarId/v1": "TK-9716b35d5c9f" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-9716b35d5c9f" } }, { "ruleId": "TATAR-RBAC-003", "level": "error", "message": { "text": "Excessive / risky permissions — Clean up permissions using least-privilege." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/wildcard-rbac.yaml" }, "region": { "startLine": 2, "endLine": 10 } } } ], "partialFingerprints": { "tatarId/v1": "TK-13f175cd7fcc" }, "properties": { "blind_shot": false, "confidence": "MEDIUM", "found_by": [ "checkov" ], "tatar_id": "TK-13f175cd7fcc" } }, { "ruleId": "TATAR-CON-009", "level": "warning", "message": { "text": "Read-only root filesystem disabled — Set securityContext.readOnlyRootFilesystem=true." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/privileged.yaml" }, "region": { "startLine": 2, "endLine": 18 } } } ], "partialFingerprints": { "tatarId/v1": "TK-082fb33745e9" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-082fb33745e9" } }, { "ruleId": "TATAR-CON-008", "level": "warning", "message": { "text": "Missing securityContext — Add a securityContext block with hardening settings." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/privileged.yaml" }, "region": { "startLine": 2, "endLine": 18 } } } ], "partialFingerprints": { "tatarId/v1": "TK-13b2dd676317" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-13b2dd676317" } }, { "ruleId": "TATAR-CON-008", "level": "warning", "message": { "text": "Missing securityContext — Add a securityContext block with hardening settings." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/host-namespaces.yaml" }, "region": { "startLine": 2, "endLine": 19 } } } ], "partialFingerprints": { "tatarId/v1": "TK-1de41f3015aa" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-1de41f3015aa" } }, { "ruleId": "TATAR-SEC-003", "level": "warning", "message": { "text": "Service account token auto-mounted — Set automountServiceAccountToken=false." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/latest-tag.yaml" }, "region": { "startLine": 2, "endLine": 16 } } } ], "partialFingerprints": { "tatarId/v1": "TK-2681ba7df61b" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-2681ba7df61b" } }, { "ruleId": "TATAR-SEC-003", "level": "warning", "message": { "text": "Service account token auto-mounted — Set automountServiceAccountToken=false." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/host-namespaces.yaml" }, "region": { "startLine": 2, "endLine": 19 } } } ], "partialFingerprints": { "tatarId/v1": "TK-2a5ed40b070f" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-2a5ed40b070f" } }, { "ruleId": "TATAR-CON-008", "level": "warning", "message": { "text": "Missing securityContext — Add a securityContext block with hardening settings." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/latest-tag.yaml" }, "region": { "startLine": 2, "endLine": 16 } } } ], "partialFingerprints": { "tatarId/v1": "TK-49fd10bac73f" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-49fd10bac73f" } }, { "ruleId": "TATAR-CON-009", "level": "warning", "message": { "text": "Read-only root filesystem disabled — Set securityContext.readOnlyRootFilesystem=true." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/latest-tag.yaml" }, "region": { "startLine": 2, "endLine": 16 } } } ], "partialFingerprints": { "tatarId/v1": "TK-516c6d9edcb3" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-516c6d9edcb3" } }, { "ruleId": "TATAR-CON-009", "level": "warning", "message": { "text": "Read-only root filesystem disabled — Set securityContext.readOnlyRootFilesystem=true." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/secret-env.yaml" }, "region": { "startLine": 2, "endLine": 21 } } } ], "partialFingerprints": { "tatarId/v1": "TK-6beef8a54dc8" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-6beef8a54dc8" } }, { "ruleId": "TATAR-CON-011", "level": "warning", "message": { "text": "Default seccomp profile not set — Set seccompProfile.type=RuntimeDefault." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/privileged.yaml" }, "region": { "startLine": 2, "endLine": 18 } } } ], "partialFingerprints": { "tatarId/v1": "TK-7195633ad1e7" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-7195633ad1e7" } }, { "ruleId": "TATAR-CON-002", "level": "warning", "message": { "text": "Container running as root — Set securityContext.runAsNonRoot=true." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/privileged.yaml" }, "region": { "startLine": 2, "endLine": 18 } } } ], "partialFingerprints": { "tatarId/v1": "TK-7be77a7df53a" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-7be77a7df53a" } }, { "ruleId": "TATAR-CON-009", "level": "warning", "message": { "text": "Read-only root filesystem disabled — Set securityContext.readOnlyRootFilesystem=true." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/root-user.yaml" }, "region": { "startLine": 2, "endLine": 20 } } } ], "partialFingerprints": { "tatarId/v1": "TK-7e89d41311ae" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-7e89d41311ae" } }, { "ruleId": "TATAR-CON-002", "level": "warning", "message": { "text": "Container running as root — Set securityContext.runAsNonRoot=true." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/host-namespaces.yaml" }, "region": { "startLine": 2, "endLine": 19 } } } ], "partialFingerprints": { "tatarId/v1": "TK-814cb7a3c114" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-814cb7a3c114" } }, { "ruleId": "TATAR-CON-011", "level": "warning", "message": { "text": "Default seccomp profile not set — Set seccompProfile.type=RuntimeDefault." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/latest-tag.yaml" }, "region": { "startLine": 2, "endLine": 16 } } } ], "partialFingerprints": { "tatarId/v1": "TK-839459326531" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-839459326531" } }, { "ruleId": "TATAR-CON-002", "level": "warning", "message": { "text": "Container running as root — Set securityContext.runAsNonRoot=true." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/root-user.yaml" }, "region": { "startLine": 2, "endLine": 20 } } } ], "partialFingerprints": { "tatarId/v1": "TK-87988c74ef05" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-87988c74ef05" } }, { "ruleId": "TATAR-CON-002", "level": "warning", "message": { "text": "Container running as root — Set securityContext.runAsNonRoot=true." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "production/deployment/api" } } } ], "partialFingerprints": { "tatarId/v1": "TK-8b4244f9cf41" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "trivy" ], "tatar_id": "TK-8b4244f9cf41" } }, { "ruleId": "TATAR-CON-011", "level": "warning", "message": { "text": "Default seccomp profile not set — Set seccompProfile.type=RuntimeDefault." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/secret-env.yaml" }, "region": { "startLine": 2, "endLine": 21 } } } ], "partialFingerprints": { "tatarId/v1": "TK-8ee9dfe4dcc7" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-8ee9dfe4dcc7" } }, { "ruleId": "TATAR-IMG-003", "level": "warning", "message": { "text": "Image uses :latest tag — Use a specific version (digest/tag)." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/latest-tag.yaml" }, "region": { "startLine": 2, "endLine": 16 } } } ], "partialFingerprints": { "tatarId/v1": "TK-a5de8cd35166" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov", "popeye" ], "tatar_id": "TK-a5de8cd35166" } }, { "ruleId": "TATAR-SEC-003", "level": "warning", "message": { "text": "Service account token auto-mounted — Set automountServiceAccountToken=false." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/root-user.yaml" }, "region": { "startLine": 2, "endLine": 20 } } } ], "partialFingerprints": { "tatarId/v1": "TK-a8737652d0ce" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-a8737652d0ce" } }, { "ruleId": "TATAR-CON-011", "level": "warning", "message": { "text": "Default seccomp profile not set — Set seccompProfile.type=RuntimeDefault." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/host-namespaces.yaml" }, "region": { "startLine": 2, "endLine": 19 } } } ], "partialFingerprints": { "tatarId/v1": "TK-a9ae78ef5560" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-a9ae78ef5560" } }, { "ruleId": "TATAR-CON-008", "level": "warning", "message": { "text": "Missing securityContext — Add a securityContext block with hardening settings." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/secret-env.yaml" }, "region": { "startLine": 2, "endLine": 21 } } } ], "partialFingerprints": { "tatarId/v1": "TK-adafa3db6d93" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-adafa3db6d93" } }, { "ruleId": "TATAR-SEC-003", "level": "warning", "message": { "text": "Service account token auto-mounted — Set automountServiceAccountToken=false." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/privileged.yaml" }, "region": { "startLine": 2, "endLine": 18 } } } ], "partialFingerprints": { "tatarId/v1": "TK-b856db0d7963" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-b856db0d7963" } }, { "ruleId": "TATAR-NET-001", "level": "warning", "message": { "text": "Missing NetworkPolicy — Define a NetworkPolicy for each namespace." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "production/deployment/api" } } } ], "partialFingerprints": { "tatarId/v1": "TK-bb3bbf42d8cd" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "kubescape" ], "tatar_id": "TK-bb3bbf42d8cd" } }, { "ruleId": "TATAR-CON-011", "level": "warning", "message": { "text": "Default seccomp profile not set — Set seccompProfile.type=RuntimeDefault." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/root-user.yaml" }, "region": { "startLine": 2, "endLine": 20 } } } ], "partialFingerprints": { "tatarId/v1": "TK-bd2b145c543d" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-bd2b145c543d" } }, { "ruleId": "TATAR-CON-008", "level": "warning", "message": { "text": "Missing securityContext — Add a securityContext block with hardening settings." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/root-user.yaml" }, "region": { "startLine": 2, "endLine": 20 } } } ], "partialFingerprints": { "tatarId/v1": "TK-c9d2c4a5f566" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-c9d2c4a5f566" } }, { "ruleId": "TATAR-CON-009", "level": "warning", "message": { "text": "Read-only root filesystem disabled — Set securityContext.readOnlyRootFilesystem=true." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/host-namespaces.yaml" }, "region": { "startLine": 2, "endLine": 19 } } } ], "partialFingerprints": { "tatarId/v1": "TK-ca93aca05b29" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-ca93aca05b29" } }, { "ruleId": "TATAR-CON-002", "level": "warning", "message": { "text": "Container running as root — Set securityContext.runAsNonRoot=true." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/latest-tag.yaml" }, "region": { "startLine": 2, "endLine": 16 } } } ], "partialFingerprints": { "tatarId/v1": "TK-d3601d8c9f44" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-d3601d8c9f44" } }, { "ruleId": "TATAR-SEC-003", "level": "warning", "message": { "text": "Service account token auto-mounted — Set automountServiceAccountToken=false." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/secret-env.yaml" }, "region": { "startLine": 2, "endLine": 21 } } } ], "partialFingerprints": { "tatarId/v1": "TK-deeec93fcca3" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-deeec93fcca3" } }, { "ruleId": "TATAR-RBAC-005", "level": "warning", "message": { "text": "Default service account in use — Create a dedicated least-privilege SA per workload." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "production/pod/latest-app-598c4dc6b8-ldjqq" } } } ], "partialFingerprints": { "tatarId/v1": "TK-e22e1d586ba2" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "popeye" ], "tatar_id": "TK-e22e1d586ba2" } }, { "ruleId": "TATAR-CON-002", "level": "warning", "message": { "text": "Container running as root — Set securityContext.runAsNonRoot=true." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/secret-env.yaml" }, "region": { "startLine": 2, "endLine": 21 } } } ], "partialFingerprints": { "tatarId/v1": "TK-ee582c898d28" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-ee582c898d28" } }, { "ruleId": "TATAR-NET-001", "level": "warning", "message": { "text": "Missing NetworkPolicy — Define a NetworkPolicy for each namespace." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/latest-tag.yaml" }, "region": { "startLine": 2, "endLine": 16 } } } ], "partialFingerprints": { "tatarId/v1": "TK-274cae99f523" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-274cae99f523" } }, { "ruleId": "TATAR-NET-001", "level": "warning", "message": { "text": "Missing NetworkPolicy — Define a NetworkPolicy for each namespace." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/root-user.yaml" }, "region": { "startLine": 2, "endLine": 20 } } } ], "partialFingerprints": { "tatarId/v1": "TK-30d71de77ed3" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-30d71de77ed3" } }, { "ruleId": "TATAR-NET-001", "level": "warning", "message": { "text": "Missing NetworkPolicy — Define a NetworkPolicy for each namespace." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/privileged.yaml" }, "region": { "startLine": 2, "endLine": 18 } } } ], "partialFingerprints": { "tatarId/v1": "TK-945b588f85be" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-945b588f85be" } }, { "ruleId": "TATAR-NET-001", "level": "warning", "message": { "text": "Missing NetworkPolicy — Define a NetworkPolicy for each namespace." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/secret-env.yaml" }, "region": { "startLine": 2, "endLine": 21 } } } ], "partialFingerprints": { "tatarId/v1": "TK-a45df52da489" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-a45df52da489" } }, { "ruleId": "TATAR-NET-001", "level": "warning", "message": { "text": "Missing NetworkPolicy — Define a NetworkPolicy for each namespace." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/host-namespaces.yaml" }, "region": { "startLine": 2, "endLine": 19 } } } ], "partialFingerprints": { "tatarId/v1": "TK-ba5a2bd17401" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-ba5a2bd17401" } }, { "ruleId": "TATAR-OPS-005", "level": "note", "message": { "text": "imagePullPolicy not set correctly — Set imagePullPolicy explicitly to IfNotPresent/Always." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/root-user.yaml" }, "region": { "startLine": 2, "endLine": 20 } } } ], "partialFingerprints": { "tatarId/v1": "TK-038d0c5df290" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-038d0c5df290" } }, { "ruleId": "TATAR-CON-010", "level": "note", "message": { "text": "Missing CPU/memory limits — Set resources.limits.cpu and .memory." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/secret-env.yaml" }, "region": { "startLine": 2, "endLine": 21 } } } ], "partialFingerprints": { "tatarId/v1": "TK-074f58bfc052" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-074f58bfc052" } }, { "ruleId": "TATAR-OPS-002", "level": "note", "message": { "text": "Missing liveness probe — Add a livenessProbe." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/host-namespaces.yaml" }, "region": { "startLine": 2, "endLine": 19 } } } ], "partialFingerprints": { "tatarId/v1": "TK-0ae0b98d93ee" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-0ae0b98d93ee" } }, { "ruleId": "TATAR-OPS-001", "level": "note", "message": { "text": "Missing readiness probe — Add a readinessProbe." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/secret-env.yaml" }, "region": { "startLine": 2, "endLine": 21 } } } ], "partialFingerprints": { "tatarId/v1": "TK-18ab67dd3f54" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-18ab67dd3f54" } }, { "ruleId": "TATAR-OPS-002", "level": "note", "message": { "text": "Missing liveness probe — Add a livenessProbe." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/secret-env.yaml" }, "region": { "startLine": 2, "endLine": 21 } } } ], "partialFingerprints": { "tatarId/v1": "TK-237bab83414e" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-237bab83414e" } }, { "ruleId": "TATAR-OPS-001", "level": "note", "message": { "text": "Missing readiness probe — Add a readinessProbe." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/privileged.yaml" }, "region": { "startLine": 2, "endLine": 18 } } } ], "partialFingerprints": { "tatarId/v1": "TK-2b7f656a9095" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-2b7f656a9095" } }, { "ruleId": "TATAR-OPS-005", "level": "note", "message": { "text": "imagePullPolicy not set correctly — Set imagePullPolicy explicitly to IfNotPresent/Always." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/privileged.yaml" }, "region": { "startLine": 2, "endLine": 18 } } } ], "partialFingerprints": { "tatarId/v1": "TK-692c88e9019b" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-692c88e9019b" } }, { "ruleId": "TATAR-CON-010", "level": "note", "message": { "text": "Missing CPU/memory limits — Set resources.limits.cpu and .memory." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/privileged.yaml" }, "region": { "startLine": 2, "endLine": 18 } } } ], "partialFingerprints": { "tatarId/v1": "TK-721ece12b07e" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-721ece12b07e" } }, { "ruleId": "TATAR-OPS-002", "level": "note", "message": { "text": "Missing liveness probe — Add a livenessProbe." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/privileged.yaml" }, "region": { "startLine": 2, "endLine": 18 } } } ], "partialFingerprints": { "tatarId/v1": "TK-74c9df40c60c" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-74c9df40c60c" } }, { "ruleId": "TATAR-CON-010", "level": "note", "message": { "text": "Missing CPU/memory limits — Set resources.limits.cpu and .memory." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/root-user.yaml" }, "region": { "startLine": 2, "endLine": 20 } } } ], "partialFingerprints": { "tatarId/v1": "TK-9ee9a819ee98" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-9ee9a819ee98" } }, { "ruleId": "TATAR-OPS-005", "level": "note", "message": { "text": "imagePullPolicy not set correctly — Set imagePullPolicy explicitly to IfNotPresent/Always." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/host-namespaces.yaml" }, "region": { "startLine": 2, "endLine": 19 } } } ], "partialFingerprints": { "tatarId/v1": "TK-ae88c4a249fc" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-ae88c4a249fc" } }, { "ruleId": "TATAR-OPS-002", "level": "note", "message": { "text": "Missing liveness probe — Add a livenessProbe." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/latest-tag.yaml" }, "region": { "startLine": 2, "endLine": 16 } } } ], "partialFingerprints": { "tatarId/v1": "TK-af8897bfd471" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-af8897bfd471" } }, { "ruleId": "TATAR-OPS-002", "level": "note", "message": { "text": "Missing liveness probe — Add a livenessProbe." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/root-user.yaml" }, "region": { "startLine": 2, "endLine": 20 } } } ], "partialFingerprints": { "tatarId/v1": "TK-b37a3556a105" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-b37a3556a105" } }, { "ruleId": "TATAR-OPS-001", "level": "note", "message": { "text": "Missing readiness probe — Add a readinessProbe." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/latest-tag.yaml" }, "region": { "startLine": 2, "endLine": 16 } } } ], "partialFingerprints": { "tatarId/v1": "TK-c4c3a4ebaadc" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov", "popeye" ], "tatar_id": "TK-c4c3a4ebaadc" } }, { "ruleId": "TATAR-OPS-001", "level": "note", "message": { "text": "Missing readiness probe — Add a readinessProbe." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/host-namespaces.yaml" }, "region": { "startLine": 2, "endLine": 19 } } } ], "partialFingerprints": { "tatarId/v1": "TK-d677b8052956" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-d677b8052956" } }, { "ruleId": "TATAR-CON-010", "level": "note", "message": { "text": "Missing CPU/memory limits — Set resources.limits.cpu and .memory." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/latest-tag.yaml" }, "region": { "startLine": 2, "endLine": 16 } } } ], "partialFingerprints": { "tatarId/v1": "TK-d83cf4dbcadb" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov", "popeye" ], "tatar_id": "TK-d83cf4dbcadb" } }, { "ruleId": "TATAR-OPS-005", "level": "note", "message": { "text": "imagePullPolicy not set correctly — Set imagePullPolicy explicitly to IfNotPresent/Always." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/secret-env.yaml" }, "region": { "startLine": 2, "endLine": 21 } } } ], "partialFingerprints": { "tatarId/v1": "TK-e424554e66b4" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-e424554e66b4" } }, { "ruleId": "TATAR-CON-010", "level": "note", "message": { "text": "Missing CPU/memory limits — Set resources.limits.cpu and .memory." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/host-namespaces.yaml" }, "region": { "startLine": 2, "endLine": 19 } } } ], "partialFingerprints": { "tatarId/v1": "TK-e674e784efe2" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-e674e784efe2" } }, { "ruleId": "TATAR-OPS-001", "level": "note", "message": { "text": "Missing readiness probe — Add a readinessProbe." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "lab/broken/root-user.yaml" }, "region": { "startLine": 2, "endLine": 20 } } } ], "partialFingerprints": { "tatarId/v1": "TK-f46eb13ab024" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "checkov" ], "tatar_id": "TK-f46eb13ab024" } }, { "ruleId": "TATAR-OPS-003", "level": "note", "message": { "text": "Orphan / dead service (no endpoints) — Delete the service or fix its selector." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "production/service/orphan-svc" } } } ], "partialFingerprints": { "tatarId/v1": "TK-45802dee62f8" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "popeye" ], "tatar_id": "TK-45802dee62f8" } }, { "ruleId": "TATAR-OPS-004", "level": "note", "message": { "text": "Unused ConfigMap / Secret — Delete the unused object." }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "production/configmap/unused-cm" } } } ], "partialFingerprints": { "tatarId/v1": "TK-497ef288eeed" }, "properties": { "blind_shot": false, "confidence": "HIGH", "found_by": [ "popeye" ], "tatar_id": "TK-497ef288eeed" } } ] } ] }