← 输入框|github.com|刷新
Skip to content

Add securityContext for PodSecurity Configuration to all scanTypes #1330

Closed

Description

@rfelber

In the scanType HelmCharts it is currently not possible to configure PodSecurityContext like fsGroup but only container specific securityContext.

All scanType Chart must be extended for that. Example:

scanner:
   # scanner.podSecurityContext -- Optional securityContext set on scanner pod (see: 
  https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
  podSecurityContext:
    fsGroup: 2000
  # scanner.securityContext -- Optional securityContext set on scanner container (see: 
  https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
  securityContext:
    # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user
    runAsNonRoot: false
    # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system
    readOnlyRootFilesystem: false
    # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated
    allowPrivilegeEscalation: false
    # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode
    privileged: false
    capabilities:
      drop:
        # scanner.securityContext.capabilities.drop[0] -- This drops all linux privileges from the container.
        - all

Activity

  1. moved this from Backlog to Todo in secureCodeBoxon Aug 31, 2022
  2. added this to the v3.15.0 milestone on Aug 31, 2022
  3. added a commit that references this issue on Sep 3, 2022
    7465795
  4. self-assigned this
    on Sep 3, 2022
  5. moved this from Todo to In Progress in secureCodeBoxon Sep 3, 2022
  6. added a commit that references this issue on Sep 5, 2022
    b631135
  7. Repository owner moved this from In Progress to Done in secureCodeBoxon Sep 5, 2022
  8. added a commit that references this issue on Sep 15, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

scannerImplement or update a security scanner

Type

No type

Projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions