8000 [pull] main from bridgecrewio:main by pull[bot] · Pull Request #537 · AmadeusITGroup/checkov · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

[pull] main from bridgecrewio:main #537

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 24, 2025
Merged

[pull] main from bridgecrewio:main #537

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1e04b7c
feat(kubernetes): include hidden folders in scan (#7219)
mayblo Jun 24, 2025
e823429
feat(kubernetes): include hidden folders in scan (#7219)
mayblo Jun 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion checkov/kubernetes/kubernetes_utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@

import dpath

from checkov.common.util.env_vars_config import env_vars_config
from checkov.common.models.enums import CheckResult
from checkov.common.util.consts import LINE_FIELD_NAMES, START_LINE, END_LINE
from checkov.runner_filter import RunnerFilter
Expand All @@ -28,6 +29,17 @@
FILTERED_RESOURCES_FOR_EDGE_BUILDERS = ["NetworkPolicy"]


def should_include_path(full_path: str, ignore_hidden_dir: bool) -> bool:
if full_path in EXCLUDED_FILE_NAMES:
return False

inside_hidden_dir = "/." in full_path
if inside_hidden_dir and ignore_hidden_dir:
return False

return True


def get_folder_definitions(
root_folder: str, excluded_paths: list[str] | None
) -> tuple[dict[str, list[dict[str, Any]]], dict[str, list[tuple[int, str]]]]:
Expand All @@ -40,7 +52,7 @@ def get_folder_definitions(
file_ending = os.path.splitext(file)[1]
if file_ending in K8_POSSIBLE_ENDINGS:
full_path = os.path.join(root, file)
if "/." not in full_path and file not in EXCLUDED_FILE_NAMES:
if should_include_path(full_path, env_vars_config.IGNORE_HIDDEN_DIRECTORIES):
# skip temp directories
files_list.append(full_path)
return get_files_definitions(files_list)
Expand Down
2 changes: 1 addition & 1 deletion checkov/version.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
version = '3.2.445'
version = '3.2.446'
2 changes: 1 addition & 1 deletion kubernetes/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
checkov==3.2.445
checkov==3.2.446
139 changes: 139 additions & 0 deletions tests/kubernetes/graph/resources/definitions/.hidden/graph_check.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,139 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: internal-proxy-deployment
labels:
app: internal-proxy
spec:
selector:
matchLabels:
app: internal-proxy
template:
metadata:
labels:
app: internal-proxy
spec:
containers:
- name: internal-api
image: madhuakula/k8s-goat-internal-api
resources:
limits:
cpu: 30m
memory: 40Mi
requests:
cpu: 30m
memory: 40Mi
ports:
- containerPort: 3000
- name: info-app
image: madhuakula/k8s-goat-info-app
resources:
limits:
cpu: 30m
memory: 40Mi
requests:
cpu: 30m
memory: 40Mi
ports:
- containerPort: 5000
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-proxy-deployment
labels:
app: external-proxy
spec:
selector:
matchLabels:
app: external-proxy
template:
metadata:
labels:
app: external-proxy
spec:
containers:
- name: internal-api
image: madhuakula/k8s-goat-internal-api
resources:
limits:
cpu: 30m
memory: 40Mi
requests:
cpu: 30m
memory: 40Mi
ports:
- containerPort: 3000
- name: info-app
image: madhuakula/k8s-goat-info-app
resources:
limits:
cpu: 30m
memory: 40Mi
requests:
cpu: 30m
memory: 40Mi
ports:
- containerPort: 5000
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-network-policy
namespace: default
spec:
podSelector:
matchLabels:
app: internal-proxy
policyTypes:
- Ingress
- Egress
ingress:
- from:
- ipBlock:
cidr: 172.17.0.0/16
except:
- 172.17.1.0/24
- podSelector:
matchLabels:
app: internal-proxy
ports:
- protocol: TCP
port: 6379
egress:
- to:
- ipBlock:
cidr: 10.0.0.0/24
ports:
- protocol: TCP
port: 5978
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: skipdeployment
annotations:
"checkov.io/skip": "CKV2_K8S_6=skip it"
labels:
app: skip
spec:
selector:
matchLabels:
app: skip
template:
metadata:
labels:
app: skip
spec:
containers:
- name: info-app
image: madhuakula/k8s-goat-info-app
resources:
limits:
cpu: 30m
memory: 40Mi
requests:
cpu: 30m
memory: 40Mi
ports:
- containerPort: 5000
209 changes: 209 additions & 0 deletions tests/kubernetes/graph/resources/definitions/custom_resource.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,209 @@
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
name: rollout-pairs-admin
annotations:
notifications.argoproj.io/subscribe.on-rollout-completed.slack: pairs-deploy-prod
notifications.argoproj.io/subscribe.on-rollout-aborted.slack: pairs-deploy-prod
spec:
strategy:
blueGreen:
# Name of the service that the rollout modifies as the active service.
activeService: service-pairs-admin-stable
# Name of the service that the rollout modifies as the preview service. +optional
# previewService: service-pairs-admin-stable

# The number of replicas to run under the preview service before the switchover. Once the rollout is resumed the new replicaset will be full scaled up before the switch occurs +optional
previewReplicaCount: 1
# Indicates if the rollout should automatically promote the new ReplicaSet to the active service or enter a paused state. If not specified, the default value is true. +optional
autoPromotionEnabled: true
# Adds a delay before scaling down the previous replicaset. If omitted, the Rollout waits 30 seconds before scaling down the previous ReplicaSet. A minimum of 30 seconds is recommended to ensure IP table propagation across the nodes in a cluster. See https://github.com/argoproj/argo-rollouts/issues/19#issuecomment-476329960 for more information
scaleDownDelaySeconds: 120
progressDeadlineSeconds: 600
progressDeadlineAbort: true
selector:
matchLabels:
app: prod-pairs-tw-admin
template:
metadata:
labels:
name: prod-pairs-tw-admin
app: prod-pairs-tw-admin
spec:
# https://aws.github.io/aws-eks-best-practices/reliability/docs/application/#schedule-replicas-across-nodes
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchExpressions:
- key: name
operator: In
values:
- prod-pairs-tw-admin
topologyKey: topology.kubernetes.io/zone
weight: 100
- podAffinityTerm:
labelSelector:
matchExpressions:
- key: name
operator: In
values:
- prod-pairs-tw-admin
topologyKey: kubernetes.io/hostname
weight: 99
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: eks.amazonaws.com/nodegroup
operator: In
values:
- prod-ceres-v124-ondemand-nodes-20221212
- prod-ceres-v124-spot-nodes-20221212
terminationGracePeriodSeconds: 50
containers:
- name: app-container
image: 953576779582.dkr.ecr.ap-northeast-1.amazonaws.com/pairs-fs/prod-tw-admin:34dfbb8b0c01b8db904b945a3790a371244839ef
ports:
- name: app
containerPort: 80
resources:
requests:
cpu: "800m"
memory: "1000M"
limits:
cpu: "800m"
memory: "1000M"
readinessProbe:
httpGet:
path: /health_check
port: 80
initialDelaySeconds: 5
periodSeconds: 3
failureThreshold: 30
livenessProbe:
httpGet:
path: /health_check
port: 80
initialDelaySeconds: 5
periodSeconds: 3
failureThreshold: 30
lifecycle:
preStop:
exec:
command: ["sh", "-c", "sleep 30"]
volumeMounts:
- name: log
mountPath: /log/
envFrom:
- configMapRef:
name: pairs-tw-admin-envs
- secretRef:
name: pairs-tw-admin-secrets
- name: td-agent
image: 953576779582.dkr.ecr.ap-northeast-1.amazonaws.com/td-agent:20221121073136master
imagePullPolicy: IfNotPresent
ports:
- name: td-agent
containerPort: 20224
resources:
requests:
cpu: "200m"
memory: "700M"
limits:
cpu: "200m"
memory: "700M"
readinessProbe:
tcpSocket:
port: 20224
initialDelaySeconds: 5
periodSeconds: 3
failureThreshold: 30
livenessProbe:
tcpSocket:
port: 20224
initialDelaySeconds: 5
periodSeconds: 3
failureThreshold: 30
lifecycle:
preStop:
exec:
command: ["sh", "-c", "sleep 30"]
volumeMounts:
- name: log
mountPath: /log/
readOnly: true
env:
- name: ENV_TD_AGENT_MODE
value: pairs
- name: ENV_TD_CUSTOMS
value: pairs_access
- name: RUN_ENV
value: prod
- name: RUN_REGION
value: tw
- name: RUN_SERVICE
value: admin
- name: METIS_PROJECT_ID
value: eure-metis
envFrom:
- secretRef:
name: pairs-admin-tdagent-secrets
- name: datadog-agent
image: 953576779582.dkr.ecr.ap-northeast-1.amazonaws.com/datadog-agent:20220530102433master
imagePullPolicy: IfNotPresent
ports:
- name: datadog
containerPort: 8126
resources:
requests:
cpu: "75m"
memory: "300M"
limits:
cpu: "75m"
memory: "300M"
readinessProbe:
tcpSocket:
port: 8126
initialDelaySeconds: 5
periodSeconds: 3
failureThreshold: 30
livenessProbe:
tcpSocket:
port: 8126
initialDelaySeconds: 5
periodSeconds: 3
failureThreshold: 30
lifecycle:
preStop:
exec:
command: ["sh", "-c", "sleep 30"]
env:
- name: DD_DOCKER_LABELS_AS_TAGS
value: '{\"role\":\"role\"}'
- name: DD_HOSTNAME
value: pairsadmin-eks-prod-tw
- name: DD_TAGS
value: 'region:tw service:pairs-admin role:admin env:prod'
- name: ENV_DD_REGION
value: tw
- name: ENV_DD_SERVICE
value: pairs-admin
- name: ENV_DD_ENV
value: prod
- name: ENV_DD_ROLE
value: admin
- name: ENV_DD_ENABLED_OPTS
value: 'nginx'
- name: KUBERNETES
value: 'yes'
- name: DD_LOGS_ENABLED
value: 'true'
- name: DD_APM_ENABLED
value: 'true'
- name: DD_APM_ENV
value: prod
envFrom:
- secretRef:
name: pairs-admin-datadog-secrets
Loading
0