bug(k8s): "trivy k8s --report all --compliance k8s-cis-1.23 --format table" doesn't show the output

[simar7]

Discussed in #9365

^{Originally posted by fjvela August 21, 2025}

Description

The command trivy k8s --report all --compliance k8s-cis-1.23 --format table doesn't show the output

If you use the json format, it does.

Desired Behavior

Shows the results

Actual Behavior

doesn't show the results

Reproduction Steps

1.Execute the command trivy k8s --report all --compliance k8s-cis-1.23 --format table
2.
3.
...

Target

Kubernetes

Scanner

None

Output Format

Table

Mode

Standalone

Debug Output

2025-08-21T15:26:25+02:00	DEBUG	No plugins loaded
2025-08-21T15:26:25+02:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-08-21T15:26:25+02:00	DEBUG	Cache dir	dir="/Users/user/Library/Caches/trivy"
2025-08-21T15:26:25+02:00	DEBUG	Cache dir	dir="/Users/user/Library/Caches/trivy"
2025-08-21T15:26:25+02:00	DEBUG	Compliance spec loaded from disk bundle	spec="k8s-cis-1.23"
2025-08-21T15:26:25+02:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-08-21T15:26:25+02:00	DEBUG	Ignore statuses	statuses=[]
2025-08-21T15:26:36+02:00	INFO	Node scanning is enabled
2025-08-21T15:26:36+02:00	INFO	If you want to disable Node scanning via an in-cluster Job, please try '--disable-node-collector' to disable the Node-Collector job.
2025-08-21T15:26:36+02:00	INFO	Scanning K8s...	K8s="kind-kind"
2025-08-21T15:26:36+02:00	DEBUG	[notification] Running version check
2025-08-21T15:26:36+02:00	DEBUG	[notification] Version check completed	latest_version="0.65.0"
2025-08-21T15:26:39+02:00	DEBUG	Cleaning up temp directory	path="/var/folders/0k/3mf2w9dn0d35t_p6ctxyqvwm0000gn/T/trivy-50881"

Operating System

macOS Sequoia

Version

Version: 0.65.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-08-21 06:28:10.725857663 +0000 UTC
  NextUpdate: 2025-08-22 06:28:10.725857382 +0000 UTC
  DownloadedAt: 2025-08-21 12:31:37.145092 +0000 UTC
Check Bundle:
  Digest: sha256:a471e90b7c7335e914ec9075b74cf8f65e4c91e6cecfa7e39c587382808d2684
  DownloadedAt: 2025-08-21 12:31:21.459663 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

As @afdesk correctly pointed out, specifying --report=all when the --compliance flag is passed is today not handled properly because compliance based results only have summary style output.

There are two ways we can proceed here:

1. Error out if --report=all is specified with --compliance based flag. Such a case a will deem the usage invalid.
2. Override --report=all to behave --report=summary if the --compliance flag is specified. Optionally we can show a WARN level message to the user mentioning the usage.