Fix: correct search for control plane containers

[alex123012]

Now in functions is_apiserver, is_etcd, is_controllermananager and is_scheduler regexes for first command entry are not "strict", so when there is more than one container in control plane pod with first command entries, for example, kube-apiserver and kube-apiserver-healthcheck - checks for control plane containers would be applied also for another (non control plane) container. This produces false negative check results.

In this PR I proposed solution for fixing this behavior.

[simar7]

could you give an example of how this would fail today (false positive)?

[simar7]

adding @chen-keinan to take a second look

[alex123012]

@simar7 Hi!
So, we are trying to run CIS benchmark with trivy-operator and receive fail for all kube-apiserver checks. Our kube-apiserver pod looks like:

apiVersion: v1
kind: Pod
metadata:
  name: kube-apiserver
  namespace: kube-system
spec:
  containers:
  - command:
    - kube-apiserver
    - "..."
    name: kube-apiserver
  - command:
    - /usr/local/bin/kube-apiserver-healthcheck
    name: healthcheck

With old regex it will check both containers in kube-apiserver pod:

(look at dev tools)

If we use regex from this PR - all works as expected (only kube-apiserver container is checked):

As you can see, examples differ only by regex in is_apiserver func

playground

[simar7]

I see - thanks that makes sense now. In that case, could you also update the unit tests for this check to make sure that we can capture this? The test file lives here https://github.com/aquasecurity/defsec/blob/master/rules/kubernetes/policies/cisbenchmarks/apiserver/audit_log_path_test.rego

You could add the input you provided in the rego playground and modify accordingly to have multiple containers as input, but only one of them triggers the check.

[alex123012]

@simar7 And hi here:)
I've added tests not to cis benchmark rules, but for lib itself.
Also i've fixed regex to proper validate abs paths for control plane binaries in pod command (refer to tests)

[simar7]

@simar7 And hi here:)
I've added tests not to cis benchmark rules, but for lib itself.
Also i've fixed regex to proper validate abs paths for control plane binaries in pod command (refer to tests)

awesome, thanks!