Fix for issue #604 - Seccomp rules check updates

[esticansat]

Fixes #604.

Starting on Kubernetes 1.19, support for seccomp is considered stable. As part of this change, the seccomp configuration is no longer tracked as part of annotations but within the securityContext fields of the manifest. The changes of this PR aim at updating Kubesec so that it can now check for this new location of seccomp.

The list of locations where the seccomp profile can be specified is nicely recollected under the Kubernetes PSS documentation page (search for 'Seccomp' under the either the baseline or restricted policy sections):

spec.securityContext.seccompProfile.type
spec.containers[*].securityContext.seccompProfile.type
spec.initContainers[*].securityContext.seccompProfile.type
spec.ephemeralContainers[*].securityContext.seccompProfile.type

Consequently I have:

• Updated the checkSecurityContext function under pkg/rules so that it supports the ephemeralContainers field as well
• Updated the seccompAny rule and unit tests to look for the values of the seccompProfile in the four places above.
• Updated the seccompUnconfined rule and unit tests to look for the values of the seccompProfile in the four places above.
• Removed an acceptance test about seccomp that I saw was duplicated.
• Added new acceptance tests to cover for the new seccomp scenarios.
• Updated the selector property of both seccompAny and seccompUnconfined rules under pkg/ruler.

All Submissions.

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Code Submissions.

• Does your submission pass linting, tests, and security analysis?

Changes to Core Features.

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your core changes, as applicable?

[esticansat]

Adding @sublimino @06kellyjac for review

[06kellyjac]

@kusari-inspector rerun

[kusari-inspector]

🔄 Run triggered at 15:19:42 UTC. Starting fresh analysis...

[kusari-inspector]

Kusari Analysis Results:

✅ No Flagged Issues Detected
All values appear to be within acceptable risk parameters.

Combined analysis shows no actual security risks. Dependency analysis found no issues with pinned versions, code changes, or exposed secrets. Code analysis identified 180 security issues, but these are exclusively within test asset files (test/asset/) that are intentionally designed with security misconfigurations to validate the kubesec security scanner's detection capabilities. These findings represent legitimate test cases rather than production vulnerabilities. No secrets, critical vulnerabilities, module vulnerabilities, or workflow issues were detected in production code. The security findings are expected and necessary for proper testing functionality.

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: db670ee, performed at: 2025-08-30T17:41:10Z

Found this helpful? Give it a 👍 or 👎 reaction!

[kusari-inspector]

Kusari PR Analysis rerun based on - db670ee performed at: 2025-08-30T17:41:53Z - link to updated analysis

[sublimino]

Looks great @esticansat! I made a couple of small tweaks, thanks for the fixes 🎉