how to deal with nested assets

[michaelkrieg]

When I use local querypacks I wonder how to deal with nested assets.
Assume the following:

I want to discover only a subset of assets in a Kubernetes cluster. The following does not work as expected:

cnquery scan k8s -o full --incognito --discover cluster --querypack-bundle my-eks.mql.yaml

Expected behaviour: only show cluster related assets, not all others (including daemonsets). The above command produces a lot of unnecessary outputs, like this:

Asset: kube-system/kube-proxy-8hzw8
-----------------------------------

asset doesn't support any querypacks

My YAML file contains also the following filter section:

        filters:
          - asset.platform == "kubernetes" || asset.platform == "k8s-cluster"

[chris-rock]

I just tested it with the query pack:

cnquery scan k8s --incognito --discover clusters --querypack-bundle mondoo-kubernetes-incident-response.mql.yaml

and it worked as expected. Be aware that the discover flag needs to be --discover clusters.

For the asset filter you only need the following filter:

filters:
  - asset.platform == "k8s-cluster"

We use both filters in the query packs to be compatible with older versions of cnquery. If you are on the latest version you do not need to have that special handling.

[michaelkrieg]

Yes, the plural clusters did the trick! Thank you once again @chris-rock.

The cmd help is not clear imho:

cnquery scan k8s --help
....
      --discover string                  Enable the discovery of nested assets. Supported: 'all|auto|instances|host-instances|host-machines|container|container-images|pods|cronjobs|statefulsets|deployments|jobs|replicasets|daemonsets' (default "auto") 
...