Describe the issue
When the input file contains a single = as a value, checkov silently ignores the file. In my opinion, this is incorrect. A file that cannot be processed should not be silently ignored and crucially should not lead to a 0 exit code.
Additional context
As far as I can tell, the problem with files containing "=" actually stems from a bug in pyyaml yaml/pyyaml#89. However a minimal example shows that pyyaml itself returns an error in this case. I assume this error is caught in checkov and then ignored.
There is a workaround for the bug posted in the linked issue, however I think even if this is fixed, the underlying issue in checkov where errors are ignored should be fixed as well.
Example
Creating a valid minimal example is a bit difficult. The only place I know of where a single = can appear in kubernetes manifest files are CRDs which are often very long. However here is an example service which still demonstrates the problem (This is invalid according to the k8s spec, but it is valid yaml)
kind: Service
metadata:
name: test
labels:
test: =
spec:
selector:
app: test
ports:
- port: 8080
targetPort: 8080
This produces the following output:
_ _
___| |__ ___ ___| | _______ __
/ __| '_ \ / _ \/ __| |/ / _ \ \ / /
| (__| | | | __/ (__| < (_) \ V /
\___|_| |_|\___|\___|_|\_\___/ \_/
By Prisma Cloud | version: 3.2.506
Whereas this is the expected output (Achieved by removing the label from the service):
_ _
___| |__ ___ ___| | _______ __
/ __| '_ \ / _ \/ __| |/ / _ \ \ / /
| (__| | | | __/ (__| < (_) \ V /
\___|_| |_|\___|\___|_|\_\___/ \_/
By Prisma Cloud | version: 3.2.506
kubernetes scan results:
Passed checks: 0, Failed checks: 1, Skipped checks: 0
Check: CKV_K8S_21: "The default namespace should not be used"
FAILED for resource: Service.default.test
File: /tests/unsafe.yaml:1-10
Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-20
1 | apiVersion: v1
2 | kind: Service
3 | metadata:
4 | name: test
5 | spec:
6 | selector:
7 | app: test
8 | ports:
9 | - port: 8080
10 | targetPort: 8080
Describe the issue
When the input file contains a single = as a value, checkov silently ignores the file. In my opinion, this is incorrect. A file that cannot be processed should not be silently ignored and crucially should not lead to a 0 exit code.
Additional context
As far as I can tell, the problem with files containing "=" actually stems from a bug in pyyaml yaml/pyyaml#89. However a minimal example shows that pyyaml itself returns an error in this case. I assume this error is caught in checkov and then ignored.
There is a workaround for the bug posted in the linked issue, however I think even if this is fixed, the underlying issue in checkov where errors are ignored should be fixed as well.
Example
Creating a valid minimal example is a bit difficult. The only place I know of where a single = can appear in kubernetes manifest files are CRDs which are often very long. However here is an example service which still demonstrates the problem (This is invalid according to the k8s spec, but it is valid yaml)
This produces the following output:
Whereas this is the expected output (Achieved by removing the label from the service):