Open SachithKasthuriarachchi opened 1 year ago
gruebel
commented
1 year ago Hey @SachithKasthuriarachchi thanks for reaching out.
Not sure how the rendered file looks like, but we identified it as not being a valid Kubernetes manifest
[DEBUG] template 0 from file base-rendered.yaml is not a valid k8s template, reason: the key apiVersion does not exist in template structure
SachithKasthuriarachchi
commented
1 year ago oh thanks @gruebel for pointing that out. Would it be more easy to debug if we change the above log from DEBUG to WARN? Also, is there any clue on identifying where the erroneous resource is?
SachithKasthuriarachchi
commented
1 year ago also please note that the same file perfectly works on Checkov 2.0.740
SachithKasthuriarachchi
commented
1 year ago checked with 2.2.150 and was able to reproduce the error. Was there any breaking changes introduced after 2.0.740?
gruebel
commented
1 year ago not really breaking change, but we check generic files like JSON/YAML for specific keywords and if they are not included that specific framework is skipped. I'm still curious, how your Kubernetes manifest can be valid without an apiVersion field https://kubernetes.io/docs/concepts/overview/working-with-objects/#required-fields
A higher log level doesn't make any sense here, because it will spam the output.Let's take a JSON file, it could be a template for ARM, CloudFormation, Kubernetes, OpenAPI, Terraform or just some generic file. We would then log a warning for each of them for each file.
SachithKasthuriarachchi
commented
1 year ago @gruebel does checkov skip running checks if the {{ symbol is present anywhere? Following are my observations.
apiVersion: v1
data:
pod-utilization.json: |-
{
"annotations": {
"list": [
{
"builtIn": 1,
"datasource": {
"type": "datasource",
"uid": "grafana"
},
"enable": true,
"hide": true,
"iconColor": "rgba(0, 211, 255, 1)",
"name": "Annotations & Alerts",
"legendFormat": "{{cluster_id}} {{pod}}/{{container}} (usage max)"
"target": {
"limit": 100,
"matchAny": false,
"tags": [],
"type": "dashboard"
},
"type": "dashboard"
}
]
}
kind: ConfigMap
metadata:
annotations:
kapp.k14s.io/disable-default-label-scoping-rules: ""
labels:
app: cost-analyzer
app.kubernetes.io/instance: kubecost
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: cost-analyzer
grafana_dashboard: "1"
helm.sh/chart: cost-analyzer-1.106.0
name: prom-benchmark-dashboard
namespace: kubecostcheckov -f invalid.yaml --framework kubernetes"{{cluster_id}} {{pod}}/{{container}} (usage max)" line in above file, Checkov worked perfectlySachithKasthuriarachchi
commented
1 year ago not really breaking change, but we check generic files like JSON/YAML for specific keywords and if they are not included that specific framework is skipped. I'm still curious, how your Kubernetes manifest can be valid without an
apiVersionfield https://kubernetes.io/docs/concepts/overview/working-with-objects/#required-fieldsA higher log level doesn't make any sense here, because it will spam the output.Let's take a JSON file, it could be a template for ARM, CloudFormation, Kubernetes, OpenAPI, Terraform or just some generic file. We would then log a warning for each of them for each file.
@gruebel I checked the generated yaml and apiVersion is present in all the resources.
gruebel
commented
1 year ago interesting we don't skip it on purpose, probably there is an issue with parsing the file.
gruebel
commented
1 year ago ok, I checked the code and we filter out content, which has {{ inside the yaml file, because we assume it will be a Helm chart.
SachithKasthuriarachchi
commented
1 year ago yes just because a file contain {{ we can't always assume it as a helm chart. The best counter-example is the rendered manifests of kubecost helm chart.
SachithKasthuriarachchi
commented
12 months ago @gruebel any plans on assigning someone from Checkov team to fix this?
SachithKasthuriarachchi
commented
9 months ago any update on this?
karthickmuthuraj
commented
9 months ago Hi Team,
Could you provide some alternate way or suggest some ideas ?
stale[bot]
commented
3 months ago Thanks for contributing to Checkov! We've automatically marked this issue as stale to keep our issues list tidy, because it has not had any activity for 6 months. It will be closed in 14 days if no further activity occurs. Commenting on this issue will remove the stale tag. If you want to talk through the issue or help us understand the priority and context, feel free to add a comment or join us in the Checkov slack channel at codifiedsecurity.slack.com Thanks!
samavasi
commented
1 month ago is there any workaround for this?
ryanbasiltrickett
commented
3 weeks ago Any updates on this issue? I have had to revert to 2.0.740 which for now is a work around but not a long term solution.
Describe the issue
Checkov (latest) does not output the results for very large files (around 50000 lines)
Update to the Description
Checkov does not analyze files with some specific symbols like
{{. Check https://github.com/bridgecrewio/checkov/issues/5643#issuecomment-1766251204 for explanationAdditional context
Command:
Debug Logs: