diff --git a/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.py b/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.py index 8ca37d8425..1de252da5f 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.py +++ b/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.py @@ -13,10 +13,8 @@ class core_minimize_net_raw_capability_admission(Check): report.status = "PASS" report.status_extended = f"Pod {pod.name} does not have NET_RAW capability." for container in pod.containers.values(): - if ( - container.security_context - and container.security_context.capabilities - and "NET_RAW" in container.security_context.capabilities.add + if "NET_RAW" in getattr( + getattr(container.security_context, "capabilities", None), "add", [] ): report.status = "FAIL" report.status_extended = f"Pod {pod.name} has NET_RAW capability in container {container.name}." diff --git a/prowler/providers/kubernetes/services/core/core_service.py b/prowler/providers/kubernetes/services/core/core_service.py index 5f3a47875c..21d0439de3 100644 --- a/prowler/providers/kubernetes/services/core/core_service.py +++ b/prowler/providers/kubernetes/services/core/core_service.py @@ -2,10 +2,10 @@ import socket from dataclasses import dataclass from typing import List, Optional -from kubernetes import client from kubernetes.client.models import V1PodSecurityContext, V1SecurityContext from pydantic import BaseModel +from kubernetes import client from prowler.lib.logger import logger from prowler.providers.kubernetes.kubernetes_provider import KubernetesProvider from prowler.providers.kubernetes.lib.service.service import KubernetesService @@ -177,7 +177,7 @@ class ConfigMap(BaseModel): name: str namespace: str uid: str - data: dict = {} + data: Optional[dict] labels: Optional[dict] kubelet_args: list = [] annotations: Optional[dict] diff --git a/prowler/providers/kubernetes/services/rbac/rbac_service.py b/prowler/providers/kubernetes/services/rbac/rbac_service.py index df0303cb65..b7d4e87522 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_service.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_service.py @@ -1,8 +1,8 @@ from typing import Any, List, Optional -from kubernetes import client from pydantic import BaseModel +from kubernetes import client from prowler.lib.logger import logger from prowler.providers.kubernetes.kubernetes_provider import KubernetesProvider from prowler.providers.kubernetes.lib.service.service import KubernetesService @@ -51,7 +51,7 @@ class Rbac(KubernetesService): logger.error( f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) - return [] + return {} def __list_role_bindings__(self): try: @@ -80,7 +80,7 @@ class Rbac(KubernetesService): logger.error( f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) - return [] + return {} def __list_roles__(self): try: @@ -105,7 +105,7 @@ class Rbac(KubernetesService): logger.error( f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) - return [] + return {} def __list_cluster_roles__(self): try: @@ -115,14 +115,18 @@ class Rbac(KubernetesService): "uid": role.metadata.uid, "name": role.metadata.name, "metadata": role.metadata, - "rules": [ - { - "apiGroups": rule.api_groups, - "resources": rule.resources, - "verbs": rule.verbs, - } - for rule in role.rules - ], + "rules": ( + [ + { + "apiGroups": rule.api_groups, + "resources": rule.resources, + "verbs": rule.verbs, + } + for rule in role.rules + ] + if role.rules + else [] + ), } cluster_roles[role.metadata.uid] = ClusterRole(**formatted_role) return cluster_roles @@ -130,7 +134,7 @@ class Rbac(KubernetesService): logger.error( f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) - return [] + return {} class Subject(BaseModel):