Support for Argo Rollouts Kubernetes Security Scanning

[ltshb]

Summary

Checkov currently lacks native support for scanning Argo Rollouts CRDs (Custom Resource Definitions). While Checkov provides a dedicated runner for Argo Workflows (argo_workflows), there is no equivalent for Argo Rollouts, preventing organizations using progressive delivery strategies from scanning Rollout manifests against Kubernetes security policies.

Problem Statement

Argo Rollouts is an increasingly popular Kubernetes controller for progressive delivery, providing advanced deployment strategies (canary, blue-green) beyond native Kubernetes Deployments. However, when attempting to scan Rollout manifests:

1. Standard Kubernetes checks are skipped — Most CKV_K8S_* checks target native kinds (Deployment, Pod, Service, etc.) and explicitly exclude custom resources
2. Pod security context validation fails — Security policies that should apply to pod templates within Rollouts are not evaluated
3. No CRD-specific checks — Unlike Argo Workflows, there are no dedicated checks for Rollout-specific fields (e.g., strategy configuration, analysis templates)
4. Kustomize integration gap — When using Kustomize overlays with Rollout resources, Checkov templates the manifests but skips security validation on the resulting Rollouts

Example: Pod Security Context Check

A Rollout manifest with pod security context:

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: my-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      securityContext:
        runAsNonRoot: true
        fsReadOnlyRootFilesystem: true
      containers:
      - name: app
        image: myapp:1.0.0
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL

Current behavior: Checks like CKV_K8S_20 (Pod security context) are not applied because the resource kind is Rollout, not Pod or Deployment.

Requested Solution

Implement a dedicated Argo Rollouts runner in Checkov, similar to the existing argo_workflows runner, with the following capabilities:

1. Native Rollout Support

• Add Rollout and related CRDs (AnalysisTemplate, AnalysisRun) to Checkov's resource kind registry
• Create a rollout runner alongside argo_workflows
• Enable scanning of Rollout manifests in both YAML files and Kustomize overlays

2. Apply Existing Kubernetes Checks to Rollout Templates

• Extend pod security checks to validate spec.template.spec within Rollouts
• Examples: CKV_K8S_20 (runAsNonRoot), CKV_K8S_38 (fsReadOnlyRootFilesystem), CKV_K8S_37 (capabilities)
• Treat Rollout spec.template similarly to how Deployment templates are validated

4. Custom Policy Support

Enable users to write custom Rollout checks using:

• YAML graph checks (similar to Checkov's existing YAML policy format)
• Python BaseK8sCheck subclasses targeting Rollout resources

Use Case

This feature is essential for organizations using Argo Rollouts in production EKS environments:

• Progressive Delivery: Teams using canary/blue-green strategies need security validation at all deployment stages
• GitOps Workflows: Argo CD + Argo Rollouts users require manifest scanning before syncing to clusters
• Compliance: Security policies must be consistently applied across both native Deployments and Rollouts
• CI/CD Integration: GitHub Actions / CodeBuild pipelines need Checkov to validate Rollout manifests alongside other IaC

Acceptance Criteria

• Argo Rollouts manifests can be scanned without being skipped
• Pod-level security checks (CKV_K8S_*) apply to Rollout spec.template.spec
• Custom Rollout checks can be written in both YAML and Python formats
• Documentation includes examples for scanning Rollout manifests in Kustomize
• Argo Workflows checks still work (no regression)

Related Resources

• Argo Rollouts Documentation: https://argoproj.github.io/rollouts/
• Existing Argo Workflows Runner: checkov/argo_workflows/runner.py
• Kubernetes Runner Reference: checkov/kubernetes/runner.py
• CRD Support Discussion: Similar requests for custom resource support (e.g., issue break(general): remove Python 3.7 #5605 in other projects)

Alternative Considerations

If a full runner is not feasible in the short term:

1. Partial Solution: Extend the Kubernetes runner to recognize Rollout kind and apply pod template checks
2. Documentation: Provide guidance on writing custom checks for Rollout-specific validation
3. Plugin System: Enable users to register CRD runners without upstreaming to Checkov core

---

Questions for Maintainers

1. Is there interest in adding CRD runners beyond Argo Workflows?
2. Would the community prefer a dedicated runner or an extension to the existing Kubernetes runner?
3. Are there any technical limitations preventing Rollout support that we should be aware of?
4. Why Support Rollout Kind #2726 was closed without comments ?

Thank you for considering this feature request. We believe Argo Rollouts support would significantly enhance Checkov's utility for progressive delivery workflows.