Kubernetes scan fails on RKE2 cluster

[jgoelen]

Description

Scanning a RKE2 cluster results in an error.

Desired Behavior

Expected a table with summary of the detected issues.

Actual Behavior

The command fails:

trivy k8s -d  --kubeconfig=$HOME/.kube/rke2-test.yaml --severity=CRITICAL --report=all cluster
2023-08-23T11:45:32.178+0200	DEBUG	Severities: ["CRITICAL"]
2023-08-23T11:45:32.179+0200	DEBUG	Ignore statuses	{"statuses": null}
2023-08-23T11:45:32.742+0200	FATAL	get k8s artifacts with node info error:
    github.com/aquasecurity/trivy/pkg/k8s/commands.clusterRun
        /home/runner/work/trivy/trivy/pkg/k8s/commands/cluster.go:34
  - .spec.template.spec.initContainers accessor error: <nil> is of the type <nil>, expected []interface{}

Reproduction Steps

Run the following command:

trivy k8s -d --kubeconfig=$HOME/.kube/rke2-test.yaml --severity=CRITICAL --report=all cluster

### Target

Kubernetes

### Scanner

None

### Output Format

Table

### Mode

Standalone

### Debug Output

```bash
2023-08-23T11:45:32.178+0200	DEBUG	Severities: ["CRITICAL"]
2023-08-23T11:45:32.179+0200	DEBUG	Ignore statuses	{"statuses": null}
2023-08-23T11:45:32.742+0200	FATAL	get k8s artifacts with node info error:
    github.com/aquasecurity/trivy/pkg/k8s/commands.clusterRun
        /home/runner/work/trivy/trivy/pkg/k8s/commands/cluster.go:34
  - .spec.template.spec.initContainers accessor error: <nil> is of the type <nil>, expected []interface{}

Operating System

MacOS 13.5.1 (22G90)

Version

trivy --version
Version: 0.44.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-08-23 06:10:04.151406946 +0000 UTC
  NextUpdate: 2023-08-23 12:10:04.151406546 +0000 UTC
  DownloadedAt: 2023-08-23 09:12:13.166276 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2023-08-23 00:59:25.619115427 +0000 UTC
  NextUpdate: 2023-08-26 00:59:25.619114827 +0000 UTC
  DownloadedAt: 2023-08-23 09:12:54.33577 +0000 UTC
Policy Bundle:
  Digest: sha256:2e95a2d5d45de8ebecae53a97403230a6c608a579b082f3de170f3cf09e46243
  DownloadedAt: 2023-08-23 09:12:14.333482 +0000 UTC

Checklist

• Run trivy image --reset
• Read the troubleshooting

[gsfd2000]

I have the same issue with k3d cluster

[gsfd2000]

was a problem with istio on my cluster, istio enabled on the namespace but the containers did not yet deploy the istio sidecar, guess it is an either or, no namespace injector and no sidecar or both active

[guillermobandres]

HI I have the same error doing a scan for deployment on a namespace. If I do the same for statefulsets it works fine. It only happens in two namespaces, the rest of them seem to work fine

trivy k8s -n $NAMESPACE --report summary deployments --scanners config --severity CRITICAL,HIGH --debug
2023-10-24T14:03:07.978Z DEBUG Severities: ["CRITICAL" "HIGH"]
2023-10-24T14:03:07.979Z DEBUG Ignore statuses {"statuses": null}
2023-10-24T14:03:08.108Z FATAL .spec.template.spec.initContainers accessor error: is of the type , expected []interface{}

[guillermobandres]

I found a deployment with the las configuration applied annotation with initContainers: null. I deleted the annotation and it works fine