k8s: scan open secrets on resources not working

[floriandreher]

Description

Hi, i wanted to scan my k8s cluster for bad config maps or pods. However, no issue was reported by trivy.
My CM:

apiVersion: v1
data:
  AWS_ACCESS_KEY_ID: <some-access-key>
  AWS_SECRET_ACCESS_KEY: <some-secret-access-key>
kind: ConfigMap
metadata:
  name: bad-cm
  namespace: default

My pod:

apiVersion: v1
kind: Pod
metadata:
  name: bad-pod
  namespace: default
spec:
  containers:
  - args:
    - bin/sh
    - -c
    - sleep 5000
    env:
    - name: AWS_ACCESS_KEY_ID
      value: <some-access-key>
    - name: AWS_SECRET_ACCESS_KEY
      value: <some-secret-access-key>
    image: busybox
    name: bad-pod
    resources: {}
  dnsPolicy: ClusterFirst
  restartPolicy: Always

What did you expect to happen?

I expected, that trivy would report my configmap and my pod like mentioned here:
#2215
The scan finishes immediately, so i'm not sure if trivy just skipped the scan.

What happened instead?

No issue was reported by trivy

Output of run with -debug:

trivy k8s --security-checks=secret cm --report=all --debug

2022-10-17T17:16:33.353+0200    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2022-10-17T17:16:33.942+0200    DEBUG   cache dir:  /<xxx>/Library/Caches/trivy
30 / 30 [------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s

trivy k8s --security-checks=secret pod --report=all --debug

2022-10-17T17:18:07.449+0200    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2022-10-17T17:18:07.869+0200    DEBUG   cache dir:  /<xxx>/Library/Caches/trivy
21 / 21 [------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% ? p/s

Output of trivy -v:

trivy --version
Version: 0.32.1

[chen-keinan]

@floriandreher thank you for reporting this issue , I will take a look at it and update you