Skip to content

feat: add new container security rules for NoNewPrivileges and SeccompProfile#299

Merged
RottenRat merged 6 commits intomainfrom
feature/sec
Oct 28, 2025
Merged

feat: add new container security rules for NoNewPrivileges and SeccompProfile#299
RottenRat merged 6 commits intomainfrom
feature/sec

Conversation

@RottenRat
Copy link
Copy Markdown
Contributor

  • Introduced NoNewPrivilegesRule to ensure containers do not allow privilege escalation.
  • Added SeccompProfileRule to validate seccomp profiles for containers, ensuring proper security configurations.
  • Updated linters settings to include new exclusion rules for NoNewPrivileges and SeccompProfile.

Example:

🐒 [no-new-privileges (#container)]
     Message:      Container's SecurityContext is missing - cannot verify allowPrivilegeEscalation setting
     Module:       kube-dns
     Object:       kind = Deployment ; name = d8-kube-dns-sts-pods-hosts-appender-webhook ; namespace = kube-system ; container = webhook
     FilePath:     templates/sts-pods-hosts-appender-webhook/deployment.yaml

🐒 [seccomp-profile (#container)]
     Message:      No seccomp profile specified - consider explicitly setting seccompProfile.type to 'RuntimeDefault'
                   for better security posture
     Module:       kube-dns
     Object:       kind = Deployment ; name = d8-kube-dns-sts-pods-hosts-appender-webhook ; namespace = kube-system ; container = webhook
     FilePath:     templates/sts-pods-hosts-appender-webhook/deployment.yaml

Evsyukov Denis and others added 5 commits August 8, 2025 14:47
…pProfile

- Introduced NoNewPrivilegesRule to ensure containers do not allow privilege escalation.
- Added SeccompProfileRule to validate seccomp profiles for containers, ensuring proper security configurations.
- Updated linters settings to include new exclusion rules for NoNewPrivileges and SeccompProfile.
- Enhanced documentation in README.md to reflect new checks and their implications.
Signed-off-by: Michail Sinelnikov <72449391+RottenRat@users.noreply.github.com>
Signed-off-by: Sinelnikov Michail <mikhail.sinelnikov@flant.com>
Signed-off-by: Sinelnikov Michail <mikhail.sinelnikov@flant.com>
Signed-off-by: Sinelnikov Michail <mikhail.sinelnikov@flant.com>
@RottenRat RottenRat self-assigned this Oct 28, 2025
Signed-off-by: Sinelnikov Michail <mikhail.sinelnikov@flant.com>
@RottenRat RottenRat marked this pull request as ready for review October 28, 2025 13:26
@RottenRat RottenRat merged commit feadef0 into main Oct 28, 2025
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants