Trivy kubernetes scans return resources without a namespace

[oatovar]

Description

GitLab Operation Container Scanning uses Trivy to scan Kubernetes clusters. Recently, we received a bug report in issue gitlab-org/gitlab#536190 that we tracked down to a Resource with an empty Namespace.

• Should this be possible?
• If so, what scenarios cause this to happen?
• Can it be remediated?

If this is a bug, I'm open to contributing a fix.

Desired Behavior

All resources have a non-empty namespace attached to them.

Actual Behavior

Some resources do not have a namespace attached to them. Specifically, it looks like some NodeComponents and Cluster resources are missing a namespace. The binary runs within a fresh Pod with no cached data.

Reproduction Steps

1. Create an Amazon EKS cluster
2. Deploy an NGINX Ingress controller
3. Run a trivy scan against the newly created cluster and specify the namespace for the controller deployed
4. Verify that there's Cluster and NodeComponents resources that do not have a namespace attached

trivy k8s --report=all --scanners=vuln --include-kinds=Deployment --disable-node-collector --db-repository "registry.gitlab.com/gitlab-org/security-products/dependencies/trivy-db-glad" --include-namespaces <NGINX_NAMESPACE> --format json --output report.json

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

I'm working on getting this.

Operating System

Amazon EKS base operating system

Version

0.58.1

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

hi @oatovar - could you please try with an updated version of Trivy? The latest release is at 0.62.1.

[oatovar]

@simar7 I've asked the customer that's experienced the issue to do so, and to also comment on this thread.

[oatovar]

I'm going to close this since they never followed up in this discussion, and I haven't been able to reproduce this.