Allow skipping scan on deployments with 0 desired replicas

[abutransistor]

Description

Trivy currently scans all deployments regardless of desired replica count. It would be great if there was an option to skip / filter based on Replica spec; such that trivy kubernetes scan would skip if the desired replica count is 0.

Target

Kubernetes

Scanner

Vulnerability

[afdesk]

@abutransistor thanks for interest in Trivy k8s scan
could you share more details about this feature?
how you see it?

[simar7]

@afdesk is this possible via a custom rego check? It sounds like a good use case for it.

[afdesk]

@afdesk is this possible via a custom rego check? It sounds like a good use case for it.

it's definitely a good idea - to skip / filter deployments with 0 replicas - thanks @abutransistor
and yes, looks like REGO rule can help it
I'd check it

[unmade]

@afdesk Thank you for looking in it, we really appreciate it!

To give a more context - when scanning a Kubernetes cluster Trivy currently scans every resource it has access to including inactive workloads. Let's say we have a Deployment with replicas set to 0. Currently, Trivy still scans it. And it would be great to have some a way to filter them out.

I played a bit with REGO checks and I couldn't find a way to filter out inactive workloads from being scanned. I see that we can only report cases where replicas are set to 0, but not excluded it.

Do you have any suggestions where to look into next?

[afdesk]

hi @unmade I'm taking a look at this feature. and have some ideas.
I'll create a new issue about it a bit later.
thanks!

[afdesk]

hi guys!

We tried to use REGO for the current Trivy, it seems it's impossible.
At first REGO rules don't affect on image scan.
but even with flag --skip-images we can't filter misconfigs by REGO, only can add a new rule.

so I've created #8078, let's see how it's going.

in any case, thanks for the suggestion

cc @abutransistor @unmade @simar7