fix(gke): Remove pod-security-policy-config check

[JohnTitor]

Remove the check as part of aquasecurity/trivy#5011

Related PRs

• fix: remove PodSecurityPolicy field defsec#1492

[CLAassistant]

All committers have signed the CLA.

[simar7]

@nikpivkin could you take a look as well?

[nikpivkin]

@simar7 I think we should first remove the PodSecurityPolicy field from defsec and the rule from trivy-policies to update the schema and documentation found in this repository.

[nikpivkin]

I opened PR aquasecurity/defsec#1492.

@simar7 I checked, and found that the policies do not use this field when scanning GKE, so they don't need to be updated. But Pod Security Policies are checked when scanning k8s. I think we should create a separate issue for that. Wdyt?

[simar7]

I opened PR aquasecurity/defsec#1492.

@simar7 I checked, and found that the policies do not use this field when scanning GKE, so they don't need to be updated. But Pod Security Policies are checked when scanning k8s. I think we should create a separate issue for that. Wdyt?

@chen-keinan what do you think? Should we deprecate PSP altogether as mentioned above?

[chen-keinan]

I opened PR aquasecurity/defsec#1492.
@simar7 I checked, and found that the policies do not use this field when scanning GKE, so they don't need to be updated. But Pod Security Policies are checked when scanning k8s. I think we should create a separate issue for that. Wdyt?

@chen-keinan what do you think? Should we deprecate PSP altogether as mentioned above?

its true psp is check with k8s however I assume if you use terraform scanner only it will not

[nikpivkin]

@chen-keinan trivy-iac also scans k8s

[chen-keinan]

@chen-keinan trivy-iac also scans k8s

isn't the rules above are made for terraform files ?

[nikpivkin]

@chen-keinan This policy is used when scanning k8s and helm.

[chen-keinan]

@chen-keinan This policy is used when scanning k8s and helm.

@nikpivkin so maybe I'm misunderstanding which policies you suggested to removed ?

[nikpivkin]

@chen-keinan PodSecurityPolicy was removed from Kubernetes in v1.25, but it is used in k8s policy. That's why I suggested creating a issue for it, but not removing the rule.

[chen-keinan]

@chen-keinan PodSecurityPolicy was removed from Kubernetes in v1.25, but it is used in k8s policy. That's why I suggested creating a issue for it, but not removing the rule.

I see , thanks for clarifications

[simar7]

I opened PR aquasecurity/defsec#1492.

@simar7 I checked, and found that the policies do not use this field when scanning GKE, so they don't need to be updated. But Pod Security Policies are checked when scanning k8s. I think we should create a separate issue for that. Wdyt?

As for the separate issue, we should do that for those policies as they don't seem to use these fields (but a separate k8s rego library).

[simar7]

@chen-keinan PodSecurityPolicy was removed from Kubernetes in v1.25, but it is used in k8s policy. That's why I suggested creating a issue for it, but not removing the rule.

I see , thanks for clarifications

I've created aquasecurity/trivy#5541 to track it.