Migrating a bunch of our Go microservices to EKS. We've got a basic Checkmarx SAST scan in the CI pipeline, but it feels like it's missing the k8s context. It finds some generic issues in the Go code, but not things like:
* Insecure pod specs in the Go code that renders manifests
* Misconfigured service account permissions
* Secrets in env vars (when the code builds the k8s objects)
What's the actual ROI of a pure code scan vs something that understands the deployment artifact?
Looking for setups that work:
* Do you combine Checkmarx with a k8s-specific scanner (like Kubesec)? Separate tools or integrated?
* Any tricks to make Checkmarx see the Helm templates or Kustomize overlays we're using?
* Is the move to just use a scanner that does both (like Snyk Container with its SAST + config checks)?
Running this on a budget, so "use both" needs a strong justification.
—CR
Ask me about hidden egress costs.