Skip to content

Commit

Permalink
Explicitly setting allowPrivilegeEscalation false
Browse files Browse the repository at this point in the history
  • Loading branch information
YannickEvers committed Oct 18, 2024
1 parent 2f08381 commit 0e7e59e
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions status/templates/deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ spec:
containers:

Check warning on line 34 in status/templates/deployment.yaml

View workflow job for this annotation

GitHub Actions / scan / Kics Helm Chart Scan

[MEDIUM] Container Running With Low UID

Check if containers are running with low UID, which might cause conflicts with the host's user table.

Check warning on line 34 in status/templates/deployment.yaml

View workflow job for this annotation

GitHub Actions / scan / Kics Helm Chart Scan

[MEDIUM] NET_RAW Capabilities Not Being Dropped

Containers should drop 'ALL' or at least 'NET_RAW' capabilities

Check warning on line 34 in status/templates/deployment.yaml

View workflow job for this annotation

GitHub Actions / scan / Kics Helm Chart Scan

[MEDIUM] Seccomp Profile Is Not Configured

Containers should be configured with a secure Seccomp profile to restrict potentially dangerous syscalls

Check warning on line 34 in status/templates/deployment.yaml

View workflow job for this annotation

GitHub Actions / scan / Kics Helm Chart Scan

[MEDIUM] Container Running With Low UID

Check if containers are running with low UID, which might cause conflicts with the host's user table.

Check warning on line 34 in status/templates/deployment.yaml

View workflow job for this annotation

GitHub Actions / scan / Kics Helm Chart Scan

[MEDIUM] NET_RAW Capabilities Not Being Dropped

Containers should drop 'ALL' or at least 'NET_RAW' capabilities

Check warning on line 34 in status/templates/deployment.yaml

View workflow job for this annotation

GitHub Actions / scan / Kics Helm Chart Scan

[MEDIUM] Seccomp Profile Is Not Configured

Containers should be configured with a secure Seccomp profile to restrict potentially dangerous syscalls
- name: {{ .Chart.Name }}
securityContext:
allowPrivilegeEscalation: false
runAsUser: {{ .Values.runAsUser }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
Expand Down

0 comments on commit 0e7e59e

Please sign in to comment.