[Bug]: Kubernetes RBAC errors about prowler

[jfagoagas]

@s4mur4i thanks for testing it, @sergargar will take a look at it later today.

Thanks for using Prowler 🙌

[s4mur4i]

Also with debug log level, not much help:

2024-05-22 13:36:47,198 [File: check.py:456] 	[Module: check]	 DEBUG: Executing check: rbac_cluster_admin_usage

2024-05-22 13:36:47,202 [File: check.py:456] 	[Module: check]	 DEBUG: Executing check: rbac_minimize_csr_approval_access
Something went wrong in rbac_minimize_csr_approval_access, please use --log-level ERROR

2024-05-22 13:36:47,203 [File: check.py:464] 	[Module: check]	 ERROR: rbac_minimize_csr_approval_access -- AttributeError[23]: 'list' object has no attribute 'values'

2024-05-22 13:36:47,205 [File: check.py:456] 	[Module: check]	 DEBUG: Executing check: rbac_minimize_node_proxy_subresource_access
Something went wrong in rbac_minimize_node_proxy_subresource_access, please use --log-level ERROR

2024-05-22 13:36:47,205 [File: check.py:464] 	[Module: check]	 ERROR: rbac_minimize_node_proxy_subresource_access -- AttributeError[23]: 'list' object has no attribute 'values'
Something went wrong in rbac_minimize_pod_creation_access, please use --log-level ERROR

2024-05-22 13:36:47,248 [File: check.py:456] 	[Module: check]	 DEBUG: Executing check: rbac_minimize_pod_creation_access

2024-05-22 13:36:47,248 [File: check.py:464] 	[Module: check]	 ERROR: rbac_minimize_pod_creation_access -- AttributeError[15]: 'list' object has no attribute 'values'

2024-05-22 13:36:47,252 [File: check.py:456] 	[Module: check]	 DEBUG: Executing check: rbac_minimize_pv_creation_access
Something went wrong in rbac_minimize_pv_creation_access, please use --log-level ERROR

2024-05-22 13:36:47,252 [File: check.py:464] 	[Module: check]	 ERROR: rbac_minimize_pv_creation_access -- AttributeError[24]: 'list' object has no attribute 'values'
Something went wrong in rbac_minimize_secret_access, please use --log-level ERROR

2024-05-22 13:36:47,255 [File: check.py:456] 	[Module: check]	 DEBUG: Executing check: rbac_minimize_secret_access

2024-05-22 13:36:47,256 [File: check.py:464] 	[Module: check]	 ERROR: rbac_minimize_secret_access -- AttributeError[15]: 'list' object has no attribute 'values'

2024-05-22 13:36:47,259 [File: check.py:456] 	[Module: check]	 DEBUG: Executing check: rbac_minimize_service_account_token_creation
Something went wrong in rbac_minimize_service_account_token_creation, please use --log-level ERROR

2024-05-22 13:36:47,259 [File: check.py:464] 	[Module: check]	 ERROR: rbac_minimize_service_account_token_creation -- AttributeError[23]: 'list' object has no attribute 'values'

2024-05-22 13:36:47,262 [File: check.py:456] 	[Module: check]	 DEBUG: Executing check: rbac_minimize_webhook_config_access
Something went wrong in rbac_minimize_webhook_config_access, please use --log-level ERROR

2024-05-22 13:36:47,263 [File: check.py:464] 	[Module: check]	 ERROR: rbac_minimize_webhook_config_access -- AttributeError[26]: 'list' object has no attribute 'values'

2024-05-22 13:36:47,265 [File: check.py:456] 	[Module: check]	 DEBUG: Executing check: rbac_minimize_wildcard_use_roles
Something went wrong in rbac_minimize_wildcard_use_roles, please use --log-level ERROR

2024-05-22 13:36:47,265 [File: check.py:464] 	[Module: check]	 ERROR: rbac_minimize_wildcard_use_roles -- AttributeError[9]: 'list' object has no attribute 'values'

2024-05-22 13:36:47,268 [File: check.py:456] 	[Module: check]	 DEBUG: Executing check: scheduler_bind_address

2024-05-22 13:36:47,270 [File: check.py:456] 	[Module: check]	 DEBUG: Executing check: scheduler_profiling

[sergargar]

Hi @s4mur4i , thanks for reaching us out! We will fix these errors shortly and let you know when it is ready 🚀

[sergargar]

@s4mur4i the above PR has the fixes for those errors, could you try it out, please?

[s4mur4i]

We are currently using the public ECR repo. can you generate a testing tag there to try it?

[sergargar]

Sure @s4mur4i you can use the tag public.ecr.aws/prowler-cloud/prowler:latest, let me know if it works.

[s4mur4i]

@sergargar it looks better, but stll see one error:

2024-05-23 07:23:07,783 [File: check.py:463] 	[Module: check]	 ERROR: core_minimize_net_raw_capability_admission -- TypeError[16]: argument of type 'NoneType' is not iterable
-> Scan completed! |▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉| 83/83 [100%] in 9.6s

Overview Results:
╭─────────────────────┬──────────────────────┬────────────────╮
│ 11.98% (460) Failed │ 86.41% (3319) Passed │ 0.0% (0) Muted │

should i open separate ticket for that?

[s4mur4i]

@sergargar I am not sure the Pr fixed the issue:

                         _
 _ __  _ __ _____      _| | ___ _ __
| '_ \| '__/ _ \ \ /\ / / |/ _ \ '__|
| |_) | | | (_) \ V  V /| |  __/ |
| .__/|_|  \___/ \_/\_/ |_|\___|_|v4.1.0
|_| the handy multi-cloud security tool

Date: 2024-05-23 15:03:45

-> Using the Kubernetes credentials below:
  · Kubernetes Pod: prowler
  · Namespace: cloud

-> Using the following configuration:
  · Config File: /home/prowler/.local/lib/python3.12/site-packages/prowler/config/config.yaml

Executing 83 checks, please wait...
Something went wrong in core_minimize_net_raw_capability_admission, please use --log-level ERROR

2024-05-23 15:03:54,158 [File: check.py:463] 	[Module: check]	 ERROR: core_minimize_net_raw_capability_admission -- TypeError[21]: argument of type 'NoneType' is not iterable
-> Scan completed! |▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉| 83/83 [100%] in 10.1s

Overview Results:
╭─────────────────────┬──────────────────────┬────────────────╮
│ 11.95% (462) Failed │ 86.44% (3341) Passed │ 0.0% (0) Muted │
╰─────────────────────┴──────────────────────┴────────────────╯

Context In-Cluster Scan Results (severity columns are for fails only):
╭────────────┬───────────┬────────────┬────────────┬────────┬──────────┬───────┬─────────╮
│ Provider   │ Service   │ Status     │   Critical │   High │   Medium │   Low │   Muted │
├────────────┼───────────┼────────────┼────────────┼────────┼──────────┼───────┼─────────┤
│ kubernetes │ core      │ FAIL (399) │          0 │    399 │        0 │     0 │       0 │
├────────────┼───────────┼────────────┼────────────┼────────┼──────────┼───────┼─────────┤
│ kubernetes │ kubelet   │ PASS (0)   │          0 │      0 │        0 │     0 │       0 │
├────────────┼───────────┼────────────┼────────────┼────────┼──────────┼───────┼─────────┤
│ kubernetes │ RBAC      │ FAIL (63)  │          0 │     63 │        0 │     0 │       0 │
╰────────────┴───────────┴────────────┴────────────┴────────┴──────────┴───────┴─────────╯
* You only see here those services that contains resources.

using latest image tag with image pull policy always

[sergargar]

Sorry @s4mur4i, you're right, I have created another PR solving the issue. I'll let you know when it is merged.

[sergargar]

@s4mur4i let me know if it works now, thanks again!