AKS multiple False Positives

[Pionerd]

IDs

AVD-KCV-0083, AVD-KCV-0088, AVD-KCV-0089, AVD-KCV-0090, AVD-KCV-0091, AVD-KCV-0092

Description

AVD-KCV-0083: verified that my AKS Kubelet does run with the flag --protect-kernel-defaults set to true
AVD-KCV-0088: --tls-cert-file is correctly set (/etc/kubernetes/certs/kubeletserver.crt)
AVD-KCV-0089: this one is a bit different, --tls-key-file is not set, but --tls-private-key-file is (/etc/kubernetes/certs/kubeletserver.key)
AVD-KCV-0090: --rotate-certificates is correctly set to true
AVD-KCV-0091: the mentioned config file (/etc/kubernetes/kubelet.conf) is not existing / used by AKS
AVD-KCV-0092: cipher suites are set (--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256)

Reproduction Steps

1. Install Trivy Operator on AKS cluster
2. Observe `cis` `ClusterComplianceReport`.

Target

Kubernetes

Scanner

Misconfiguration

Target OS

Ubuntu

Debug Output

N/A

Version

trivy-operator:0.19.2

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[chen-keinan]

@Pionerd can you please open this issue on trivy-operator github and we can take discussion their.

[chen-keinan]

@Pionerd opened an issue aquasecurity/trivy-operator#1970