Shopify / kubeaudit

kubeaudit helps you audit your Kubernetes clusters against common security controls
MIT License
1.88k stars 185 forks source link

kubeaudit autofix add `targetPort: 0` on a `Service` object #555

Open arthurzenika opened 1 year ago

arthurzenika commented 1 year ago
ISSUE TYPE

BUG REPORT

SUMMARY

For a kind: Service kubeaudit autofix add a targetPort: 0 which I don't understand, and I can't find any documentation on why this is a recommended change.

--- a/tomcat-service.yaml
+++ b/tomcat-service.yaml
@@ -8,7 +8,10 @@ spec:
   ports:
     - name: http
       port: 8080
+      targetPort: 0
     - name: jmx
       port: 1089
+      targetPort: 0
   selector:
     name: tomcat
ENVIRONMENT
STEPS TO REPRODUCE

launch kubeaudit autofix on

---
apiVersion: v1
kind: Service
metadata:
  name: tomcat
spec:
  ports:
    - name: http
      port: 8080
    - name: jmx
      port: 1089
  selector:
    name: tomcat
EXPECTED RESULTS

If there is a valid reason for this, maybe a comment could be added to the yaml ? Or some documentation in the kubeaudit project ?

arthurzenika commented 1 year ago

Following a discussion with a colleague that knows a bit more about Kubernetes than me, I think this is a bug.