Missing documented workload checks in prowler kubernetes scan output
#7,630 建立於 2025年4月29日
倉庫指標
- 星標
- (8,957 顆星)
- PR 合併指標
- (平均合併 9天 17小時) (30 天內合併 314 個 PR)
描述
New feature motivation
Hi Prowler team 👋,
According to the official documentation on the Prowler website (Kubernetes Policy Index), there are several valuable workload-level checks listed, such as:
- Ensure liveness probe is configured
- Ensure readiness probe is configured
- Ensure CPU request is set
- Ensure CPU limits are set
- Ensure memory requests are set
- Ensure memory limits are set
- Ensure image tag is set to Fixed – not Latest or Blank
However, when I run prowler kubernetes --list-checks using version v5.5.1, none of these checks appear in the output. Additionally, even after deploying intentionally misconfigured workloads (e.g., missing probes or resource limits), they do not show up in the scan results.
Solution Proposed
These are very important security and reliability best practices, especially for production Kubernetes environments, and it would be great to have them included by default in the scan.
Describe alternatives you've considered
Additional context
Environment:
Prowler version: v5.5.1 Mode: Kubernetes scan running in-cluster Platform: EKS
Would appreciate any clarification, and happy to help test if needed. Thanks for your great work on this project! 🙌