diff --git a/assets/queries/k8s/host_aliases_undefined_or_empty/metadata.json b/assets/queries/k8s/host_aliases_undefined_or_empty/metadata.json deleted file mode 100644 index 9559de64624..00000000000 --- a/assets/queries/k8s/host_aliases_undefined_or_empty/metadata.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "id": "72b03514-20ae-4409-8842-2dd70c2e25aa", - "queryName": "Host Aliases Undefined Or Empty", - "severity": "HIGH", - "category": "Insecure Configurations", - "descriptionText": "A Pod should have Host Aliases defined as to prevent the container from modifying the file after a pod's containers have already been started. This means the attribute 'spec.hostAliases' must be defined and not empty or null.", - "descriptionUrl": "https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/", - "platform": "Kubernetes", - "descriptionID": "75fe4d39" -} diff --git a/assets/queries/k8s/host_aliases_undefined_or_empty/query.rego b/assets/queries/k8s/host_aliases_undefined_or_empty/query.rego deleted file mode 100644 index 84370be6b3b..00000000000 --- a/assets/queries/k8s/host_aliases_undefined_or_empty/query.rego +++ /dev/null @@ -1,49 +0,0 @@ -package Cx - -import data.generic.k8s as k8sLib -import data.generic.common as common_lib - -CxPolicy[result] { - document := input.document[i] - kind := document.kind - listKinds := ["Pod"] - k8sLib.checkKind(kind, listKinds) - - spec := document.spec - not common_lib.valid_key(spec, "hostAliases") - - metadata := document.metadata - - result := { - "documentId": document.id, - "searchKey": sprintf("metadata.name={{%s}}.spec", [metadata.name]), - "issueType": "MissingAttribute", - "keyExpectedValue": sprintf("metadata.name=%s.spec.hostAliases is defined", [metadata.name]), - "keyActualValue": sprintf("metadata.name=%s.spec.hostAliases is undefined", [metadata.name]), - } -} - -CxPolicy[result] { - document := input.document[i] - kind := document.kind - listKinds := ["Pod"] - k8sLib.checkKind(kind, listKinds) - - spec := document.spec - checkAction(spec.hostAliases) - - metadata := document.metadata - - result := { - "documentId": document.id, - "searchKey": sprintf("metadata.name={{%s}}.spec.hostAliases", [metadata.name]), - "issueType": "IncorrectValue", - "keyExpectedValue": sprintf("metadata.name=%s.spec.hostAliases is not empty", [metadata.name]), - "keyActualValue": sprintf("metadata.name=%s.spec.hostAliases is empty", [metadata.name]), - } -} - -checkAction(action) { - is_array(action) - count(action) == 0 -} diff --git a/assets/queries/k8s/host_aliases_undefined_or_empty/test/negative.yaml b/assets/queries/k8s/host_aliases_undefined_or_empty/test/negative.yaml deleted file mode 100644 index 4f4f2679437..00000000000 --- a/assets/queries/k8s/host_aliases_undefined_or_empty/test/negative.yaml +++ /dev/null @@ -1,23 +0,0 @@ -#this code is a correct code for which the query should not find any result -apiVersion: v1 -kind: Pod -metadata: - name: hostaliases-pod -spec: - restartPolicy: Never - hostAliases: - - ip: "127.0.0.1" - hostnames: - - "foo.local" - - "bar.local" - - ip: "10.1.2.3" - hostnames: - - "foo.remote" - - "bar.remote" - containers: - - name: cat-hosts - image: busybox - command: - - cat - args: - - "/etc/hosts" \ No newline at end of file diff --git a/assets/queries/k8s/host_aliases_undefined_or_empty/test/positive.yaml b/assets/queries/k8s/host_aliases_undefined_or_empty/test/positive.yaml deleted file mode 100644 index b14a2099ddd..00000000000 --- a/assets/queries/k8s/host_aliases_undefined_or_empty/test/positive.yaml +++ /dev/null @@ -1,64 +0,0 @@ -#this is a problematic code where the query should report a result(s) -apiVersion: v1 -kind: Pod -metadata: - name: hostaliases-pod -spec: - restartPolicy: Never - containers: - - name: cat-hosts - image: busybox - command: - - cat - args: - - "/etc/hosts" - ---- - -apiVersion: v1 -kind: Pod -metadata: - name: hostaliases-pod2 -spec: - restartPolicy: Never - hostAliases: [] - containers: - - name: cat-hosts - image: busybox - command: - - cat - args: - - "/etc/hosts" - ---- - -apiVersion: v1 -kind: Pod -metadata: - name: hostaliases-pod3 -spec: - restartPolicy: Never - hostAliases: - containers: - - name: cat-hosts - image: busybox - command: - - cat - args: - - "/etc/hosts" ---- - -apiVersion: v1 -kind: Pod -metadata: - name: hostaliases.pod3 -spec: - restartPolicy: Never - hostAliases: - containers: - - name: cat-hosts - image: busybox - command: - - cat - args: - - "/etc/hosts" diff --git a/assets/queries/k8s/host_aliases_undefined_or_empty/test/positive_expected_result.json b/assets/queries/k8s/host_aliases_undefined_or_empty/test/positive_expected_result.json deleted file mode 100644 index ff54b486d07..00000000000 --- a/assets/queries/k8s/host_aliases_undefined_or_empty/test/positive_expected_result.json +++ /dev/null @@ -1,22 +0,0 @@ -[ - { - "queryName": "Host Aliases Undefined Or Empty", - "severity": "HIGH", - "line": 6 - }, - { - "queryName": "Host Aliases Undefined Or Empty", - "severity": "HIGH", - "line": 24 - }, - { - "queryName": "Host Aliases Undefined Or Empty", - "severity": "HIGH", - "line": 39 - }, - { - "queryName": "Host Aliases Undefined Or Empty", - "severity": "HIGH", - "line": 55 - } -] diff --git a/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/metadata.json b/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/metadata.json deleted file mode 100644 index 388e34430ba..00000000000 --- a/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/metadata.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "id": "5d05ea11-ae3e-470e-9864-97e55fb2b2e0", - "queryName": "Host Aliases Undefined Or Empty", - "severity": "HIGH", - "category": "Insecure Configurations", - "descriptionText": "A Kubernetes Pod should have Host Aliases defined as to prevent the container from modifying the file after a pod's containers have already been started. This means the attribute 'spec.host_aliases' must be defined and not empty or null.", - "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/pod#host_aliases", - "platform": "Terraform", - "descriptionID": "00b89600" -} diff --git a/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/query.rego b/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/query.rego deleted file mode 100644 index 84e19f08479..00000000000 --- a/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/query.rego +++ /dev/null @@ -1,18 +0,0 @@ -package Cx - -import data.generic.common as common_lib - -CxPolicy[result] { - resource := input.document[i].resource.kubernetes_pod[name] - - spec := resource.spec - not common_lib.valid_key(spec, "host_aliases") - - result := { - "documentId": input.document[i].id, - "searchKey": sprintf("kubernetes_pod[%s].spec", [name]), - "issueType": "MissingAttribute", - "keyExpectedValue": sprintf("kubernetes_pod[%s].spec.host_aliases is defined and not null", [name]), - "keyActualValue": sprintf("kubernetes_pod[%s].spec.host_aliases is undefined or null", [name]), - } -} diff --git a/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/test/negative.tf b/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/test/negative.tf deleted file mode 100644 index 5807ecf042e..00000000000 --- a/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/test/negative.tf +++ /dev/null @@ -1,33 +0,0 @@ -resource "kubernetes_pod" "name1" { - metadata { - name = "with-pod-affinity" - } - - spec { - affinity { - pod_affinity { - required_during_scheduling_ignored_during_execution { - label_selector { - match_expressions { - key = "security" - operator = "In" - values = ["S1"] - } - } - - topology_key = "failure-domain.beta.kubernetes.io/zone" - } - } - } - - container { - name = "with-pod-affinity" - image = "k8s.gcr.io/pause:2.0" - } - - host_aliases { - id = "127.0.0.1" - hostnames = ["localhost"] - } - } -} diff --git a/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/test/positive.tf b/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/test/positive.tf deleted file mode 100644 index 56ca21c04b1..00000000000 --- a/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/test/positive.tf +++ /dev/null @@ -1,28 +0,0 @@ -resource "kubernetes_pod" "name1" { - metadata { - name = "with-pod-affinity" - } - - spec { - affinity { - pod_affinity { - required_during_scheduling_ignored_during_execution { - label_selector { - match_expressions { - key = "security" - operator = "In" - values = ["S1"] - } - } - - topology_key = "failure-domain.beta.kubernetes.io/zone" - } - } - } - - container { - name = "with-pod-affinity" - image = "k8s.gcr.io/pause:2.0" - } - } -} diff --git a/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/test/positive_expected_result.json b/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/test/positive_expected_result.json deleted file mode 100644 index 1f265c2d605..00000000000 --- a/assets/queries/terraform/kubernetes/host_aliases_undefined_or_empty/test/positive_expected_result.json +++ /dev/null @@ -1,7 +0,0 @@ -[ - { - "queryName": "Host Aliases Undefined Or Empty", - "severity": "HIGH", - "line": 6 - } -]