{ "schemaVersion": "catalog-shared-check-receipt-v1", "subject": { "id": "grafana-tempo-1-24-4-s3-query-observability", "chart": "grafana/tempo", "version": "1.24.4", "base": "s3-query-observability", "renderPath": "recipes/grafana/tempo/1.24.4/revisions/s3-query-observability/r001/rendered/release-objects.yaml", "renderFileSHA256": "sha256:4e981336df773cdd82b2551d35d27d61f4b39e6a3df0a9a693ac81fd0d3cf8ed" }, "catalogReview": { "path": "recipes/grafana/tempo/1.24.4/revisions/s3-query-observability/r001/receipts/scan-receipt.yaml", "note": "Separate chart-specific Catalog review; not a cub check result." }, "scannerResult": { "schema_version": "risk-scan-findings-v1", "surface": "cub-scan", "finding_count": 6, "findings": [ { "id": "CCVE-2025-3201", "name": "IngressClass not found when Ingress specifies ingressClassName", "category": "DEPEND", "track": "misconfiguration", "detection_method": "native_rule", "severity": "critical", "confidence": "high", "tool": "ingress-nginx", "resource": { "kind": "Ingress", "name": "tempo", "namespace": "tempo" }, "message": "Ingress references missing IngressClass \"nginx\"", "remedy_type": "diagnose_then_fix", "remedy_safety": "manual_only", "remediation": { "steps": [ "Identify which ingressClassName the Ingress resources are using", "Check if the corresponding IngressClass exists", "Create the missing IngressClass resource", "Verify the controller's spec.controller matches the IngressClass", "Restart the ingress controller if needed" ], "commands": [ "kubectl get ingress -A -o jsonpath='{range .items[*]}{.spec.ingressClassName}{\"\\n\"}{end}' | sort -u", "kubectl get ingressclass", "cat < -n -o jsonpath='{.spec.template.spec.containers[*].resources}'" ] }, "evidence_source": "native", "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Set resources.limits.cpu and resources.limits.memory on every container", "command": "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.containers[*].resources}'", "doc_ref": "cub-scan --explain CCVE-2025-3749" } }, { "id": "CCVE-2025-3750", "name": "StatefulSet containers omit resource requests", "category": "CONFIG", "track": "misconfiguration", "detection_method": "native_rule", "severity": "warning", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "StatefulSet", "name": "tempo", "namespace": "tempo" }, "message": "StatefulSet containers omit resource requests; HPA and scheduler decisions will be unreliable", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Set resources.requests.cpu and resources.requests.memory on every container", "Align requests with observed steady-state usage", "Ensure requests are set when using HPA" ], "commands": [ "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.containers[*].resources}'" ] }, "evidence_source": "native", "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Set resources.requests.cpu and resources.requests.memory on every container", "command": "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.containers[*].resources}'", "doc_ref": "cub-scan --explain CCVE-2025-3750" } }, { "id": "CCVE-2025-3752", "name": "StatefulSet does not disable automountServiceAccountToken", "category": "SECURITY", "track": "misconfiguration", "detection_method": "native_rule", "severity": "warning", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "StatefulSet", "name": "tempo", "namespace": "tempo" }, "message": "StatefulSet does not set automountServiceAccountToken: false; pods get unnecessary API credentials", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Set automountServiceAccountToken to false in the pod spec", "Only enable it for pods that genuinely need Kubernetes API access", "Use dedicated service accounts with minimal RBAC for pods that need API access" ], "commands": [ "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'" ] }, "evidence_source": "native", "control_ids": [ "CTRL-RBAC-0002" ], "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Set automountServiceAccountToken to false in the pod spec", "command": "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'", "doc_ref": "cub-scan --explain CCVE-2025-3752" } }, { "id": "CCVE-2025-3765", "name": "Ingress has no TLS configuration", "category": "SECURITY", "track": "misconfiguration", "detection_method": "native_rule", "severity": "warning", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "Ingress", "name": "tempo", "namespace": "tempo" }, "message": "Ingress has no TLS configuration; traffic is unencrypted", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Add spec.tls with the appropriate hosts and secretName", "Create a TLS Secret with the certificate and key", "Consider using cert-manager for automatic certificate management" ], "commands": [ "kubectl get ingress -n -o jsonpath='{.spec.tls}'" ] }, "evidence_source": "native", "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Add spec.tls with the appropriate hosts and secretName", "command": "kubectl get ingress -n -o jsonpath='{.spec.tls}'", "doc_ref": "cub-scan --explain CCVE-2025-3765" } }, { "id": "CCVE-2025-5013", "name": "Helm-managed StatefulSet may orphan PVCs on release lifecycle operations", "category": "ORPHAN", "track": "misconfiguration", "detection_method": "native_rule", "severity": "warning", "confidence": "medium", "tool": "helm", "resource": { "kind": "StatefulSet", "name": "tempo", "namespace": "tempo" }, "message": "Helm-managed StatefulSet with volumeClaimTemplates is missing Delete/Delete PVC retention policy and can orphan storage on release lifecycle operations", "remedy_type": "config_fix", "remedy_safety": "manual_only", "remediation": { "steps": [ "Set persistentVolumeClaimRetentionPolicy to Delete/Delete for ephemeral lifecycle expectations", "Document explicit PVC retention and cleanup procedures when Retain is intentional", "Add release cleanup automation for orphaned PVCs if data retention is not required" ], "commands": [ "kubectl get sts -n -o yaml", "kubectl get pvc -n -l app.kubernetes.io/instance=" ] }, "evidence_source": "native", "action_type": "human-decision", "next_step": { "action": "update_config", "description": "Set persistentVolumeClaimRetentionPolicy to Delete/Delete for ephemeral lifecycle expectations", "command": "kubectl get sts -n -o yaml", "doc_ref": "cub-scan --explain CCVE-2025-5013" } } ], "provenance": { "source": "cub-scan", "source_version": "v0.7.3", "scan_time": "2026-08-24T16:00:34Z", "catalog_version": "risk-catalog-v1.json@7ff79a126ad9" }, "pattern_bundle": { "schema_version": "bundle-manifest-v1", "version": "v0.7.3", "source_repo": "confighubai/confighub-scan", "manifest_sha256": "0405f6ffe21e567adf5d6a732d181c7f228194920456d046b4338baeb14de1a8", "catalog_sha256": "7ff79a126ad99bba2505fec8b2b7711c03f50eb362141128ec1c83e27a5036ba" }, "input": { "object_count": 8, "object_set_sha256": "sha256:f7f3572d84aae174842ba253ed7b6b9ca19a92586051176f91e4120e44d2d1c9" } } }