nilsgstrabo
commented
1 year ago We have fixed the securityContext for the oauth proxy pods created by radix-operator, so these will no longer show in the report.
The remaining pods in the wellcom-msa-app namespaces are created by Tekton. We set the correct securityContext on the task containers, but Tekton injects a few init containers without securityContext, and we have no way to control the securityContext configuration for these. Ref issue reported to Tekton
Security policy reports list many pods running as root.
This should not be possible.
List: acdocs-prod/frontend-aux-oauth-59cc567587-x2kd6 btp-docs-prod/docs-aux-oauth-fff84d6fd-vxbjn cbm-integration-staging/api-aux-oauth-7bd4785b57-m7gkb cbm-machine-docs-prod/docs-aux-oauth-77bbc6fbc5-n4jrs default/node-debugger-aks-nodepool1-28880824-vmss00002q-c6mq7 default/node-debugger-aks-nodepool1-28880824-vmss00008k-75m6d eit-luma-x-report-production/web-aux-oauth-6fdf6965b4-t26l9 equinor-chat-dev/main-aux-oauth-7cf7696bb5-q46v2 equinor-chat-prod/main-aux-oauth-7cf7696bb5-dw6pl flow-landingpage-prod/web-aux-oauth-6c4f5f46cf-9t29h flow-landingpage-qa/web-aux-oauth-7b8d97bb59-nfzxn fmu-dev/web-aux-oauth-6784769485-4gzv8 fmu-prod/web-aux-oauth-6784769485-c7pjs formel-test/api-85c96f5765-fgmnw formel-test/mitm-7c757564cc-sq69j formel-test/oauth2-55f57b564b-tsd2n formel-test/redis-5db9fcdc64-xhgdb fusion-bmt-pr/frontend-799759f97b-g6mmb fusion-dcd-apim/frontend-67b7c4b474-mh4j7 fusion-dcd-demo/backend-6dcf8947bc-tgdlm fusion-dcd-demo/frontend-77d4f9ffd6-8wcs4 fusion-dcd-pr/backend-5768f8c6d5-kshl5 fusion-dcd-pr/frontend-5b9666fd54-7zb5z geong-dev/app-aux-oauth-68b87d78c9-6wn9p geong-prod/app-aux-oauth-68b87d78c9-gxfdt geong-test/app-aux-oauth-68b87d78c9-gm4cm itcloudnet-prod/frontend-aux-oauth-568757cb59-vv5fl itpronetdocs-prod/frontend-aux-oauth-666d96654b-5th8x maintenance-api-event-driven-docs-prod/docs-aux-oauth-6f6bf84f54-fbpqk maintenance-api-event-driven-docs-qa/docs-aux-oauth-6f6bf84f54-fgtsl mars-app-dev/main-aux-oauth-5dbd549bf7-hgfb7 mars-app-prod/main-aux-oauth-5dbd549bf7-g5m4z mars-app-test/main-aux-oauth-5dbd549bf7-ngwsz mars-webviz-dev/main-aux-oauth-59b449567f-6kvd4 mars-webviz-lab/main-aux-oauth-59b449567f-s4rqb mars-webviz-prod/main-aux-oauth-59b449567f-bmr5b morphometric-db-prod/morphometric-aux-oauth-55bbb989f7-k54ch omnia-data-catalog-api-development/omniadatacatalogapi-c8b8b9b6b-gblkv omnia-data-catalog-api-feature/omniadatacatalogapi-59f676cd57-h4dh2 onboarding-single/web-aux-oauth-85d4d7579-xhcjf origo-docs-single/app-aux-oauth-745c7ddcf-8tgvj pepm-prod/api-d64f6bcb9-ccpv4 radix-networkpolicy-canary-oauthdenyall/web-aux-oauth-58bfd8c967-mq8vz real-analytics-dashboard-dev/app-aux-oauth-569f7fbcbb-hs2f2 sapo-beta/frontend-aux-oauth-9d8b55d4b-hbqhf sapo-dev/config-aux-oauth-6db55f8787-jczx8 sapo-dev/frontend-aux-oauth-5cd4455fc7-qvdbw sapo-docs-latest/internal-aux-oauth-75c764f7d-9xcrr sapo-docs-latest/public-aux-oauth-5f5599dfc6-4dnf6 sapo-qa/frontend-aux-oauth-7bbc655844-8wfvr sapo-test/config-aux-oauth-7f7bc6865d-xmp72 sapo-test/frontend-aux-oauth-54684495f4-btfhh septic-howto-dev/frontend-aux-oauth-7986f89c9c-rnp98 sna-marin-single/web-aux-oauth-7f98b87dc6-52948 sna-marin-single/web-aux-oauth-7f98b87dc6-tbvlg subopsdocs-prod/mkdocs-aux-oauth-bd795f994-nnvsf team-hermes-monitoring-prod/uptime-kuma-aux-oauth-595557fddb-64bzh trb-single/web-aux-oauth-7d6948f544-28dqg velero/velero-7fb9ff4447-s4n9t vortex-frontends-currentfeature/cow-web-aux-oauth-5f8cdb9b4c-c9nmq vortex-frontends-currentfeature/vortex-admin-web-aux-oauth-65c7796599-lssgj vortex-frontends-currentfeature/vortex-client-web-aux-oauth-75dd79565d-z7t7s vortex-frontends-dev/cow-web-aux-oauth-5899565656-tss4f vortex-frontends-dev/vortex-admin-web-aux-oauth-cbbc99848-65qtd vortex-frontends-dev/vortex-client-web-aux-oauth-75dd79565d-57jjf vortex-frontends-minimap/cow-web-aux-oauth-5899565656-hxlgb vortex-frontends-minimap/vortex-admin-web-aux-oauth-cbbc99848-xwgbj vortex-frontends-minimap/vortex-client-web-aux-oauth-75dd79565d-5fpj9 vortex-frontends-prod/cow-web-aux-oauth-5d9fcf788f-t4nzf vortex-frontends-prod/vortex-admin-web-aux-oauth-5fb4f947c4-2zsrq vortex-frontends-prod/vortex-client-web-aux-oauth-dc647d75c-vc9bc vortex-frontends-rule/vortex-client-web-aux-oauth-75dd79565d-xs6xc vortex-frontends-test/cow-web-aux-oauth-75c6484b7d-jc592 vortex-frontends-test/vortex-admin-web-aux-oauth-ff69df489-gb2vj vortex-frontends-test/vortex-client-web-aux-oauth-7dc44755d6-rr6jm webviz-spatialdb-v1-dev/main-aux-oauth-5c674b8cf5-x2h5p webviz-spatialdb-v1-prod/main-aux-oauth-5c674b8cf5-kskpz wellcom-msa-app/rad14856fe3d6123bd02b8a60a74b97f751b2291cf061592420c56a306a-pod wellcom-msa-app/rad26445139a529b779fd507625214c980f329e7732dad47ec767dc1600-pod wellcom-msa-app/rad2e346fcf7cfa087a6b6b3982bebe156622a3a93cd181ee63660b73bb-pod wellcom-msa-app/rad301c8c41ec5c01822f7e7c365fa2c87723501e4ac1fae20a033f92a8-pod wellcom-msa-app/rad3925cbd9ba353b96ea81cb979d9131fd8bfff3b7fd790c1ef4ba8393-pod wellcom-msa-app/rad543da3c54f402ea795f3bd3ba09e748de3c0e3e0e89f0bf7839fcc0a wellcom-msa-app/rad59e69c5c10415850d52cfe2398145f0a207a8c5997747ce73967c922-pod wellcom-msa-app/rada7b4bf03009736b99e4762e5399f1302f27078c540e01e20a8dd1755-pod wellcom-msa-app/radaadcd1d33919ea29392385c158762cdcdcc80d069454d11f9d2c88ec-pod wellcom-msa-app/radccb93d7f6b1764a62ff7beef2c769819ade6e2708389c3f71a33b66e-pod wellcom-msa-app/radf5fc0a030abc56991dec720454aab9822d69718bb39542af0820edbb-pod wellcom-msa-app/radi14856fe3d6123bd02b8a60ac7e8a7510e1de296dd0e049681e9557a-pod wellcom-msa-app/radi26445139a529b779fd50762d1947db15748b15d7c7da3159e812728-pod wellcom-msa-app/radi2e346fcf7cfa087a6b6b398c82602c05117c2136a7b656ddb46c567-pod wellcom-msa-app/radi301c8c41ec5c01822f7e7c38d7d9198cddee1050aeaae025c72f3d7-pod wellcom-msa-app/radi59e69c5c10415850d52cfe2ddb39e4dedf00cc87dad3cfcddeaaac9-pod wellcom-msa-app/radi5ed7a53a31b4efd5191b2ee61b4f64e4cca8a3c4d8386e522c0b4f0-pod wellcom-msa-app/radi9f3005da3d3b8fb0ef03dccfbc2ac47ff9be07d75a599928aea17ff-pod wellcom-msa-app/radif5fc0a030abc56991dec72000ea338bb369f093e73548bbf2add13e-pod wellcom-msa-app/radix-26445139a529b779fd507c59503e6fdd819bc6c02ba81df22ea41-pod wellcom-msa-app/radix-2e346fcf7cfa087a6b6b30acd66836d47eb6a7b49e5feded329e8-pod wellcom-msa-app/radix-301c8c41ec5c01822f7e7036794a7b06e54ba70d0d7c06ba23657-pod wellcom-msa-app/radix-344a48b7beca24ec6671a90ded1859d18b27c711995ecb437fd41-pod wellcom-msa-app/radix-36971d3f92bd778be0510e923ec5470bd243dca4242258725ec86-pod wellcom-msa-app/radix-59e69c5c10415850d52cf2c3566743c58b44681d0a700eb3a77b3-pod wellcom-msa-app/radix-9f97965980cd7039a49c92a71d384adecbee741072daff0d38498-pod wellcom-msa-app/radix-f5fc0a030abc56991dec7af8d48449ea49b647da6e59d10b66c08-pod wellcom-msa-app/radix-pi158989df12275a458c45e6e086740f3edf4ea19760e5338e09c-pod wellcom-msa-app/radix-pi26445139a529b779fd5c811f354715281f20eccee0a6b5a0d19-pod wellcom-msa-app/radix-pi2e346fcf7cfa087a6b695890fc01c953dea02df8e9ac63f5850-pod wellcom-msa-app/radix-pi301c8c41ec5c01822f70867e8256357caf7bf4f62ce0e3b349e-pod wellcom-msa-app/radix-pi3a0db905119ec484a793abe1cd57153115c168682179c149dff-pod wellcom-msa-app/radix-pi49a38447976a62e9ef090cc891a44cff67525c884f12b9fb5ec-pod wellcom-msa-app/radix-pi59e69c5c10415850d52041b933d302d5836746b5f9c47f8087a-pod wellcom-msa-app/radix-pi70c9faed71a6190f50acab4b04c12f51659f17e4d51a081e024-pod wellcom-msa-app/radix-pi789a904f186cd7f454fba425227e535eb30fc6d151ca65c9f45-pod wellcom-msa-app/radix-pi8940553a6e848183eac5e7ab1f1fbebda3f47b6d5cd6ce1f83e-pod wellcom-msa-app/radix-pi8a2b090bb41d9113b7141d0a9f82d079470ef349f40a04c0ed9-pod wellcom-msa-app/radix-pia452455f4a7c061d3bbd7f3788cd063c3c2fe350e1c6dfd9b8e-pod wellcom-msa-app/radix-piccb93d7f6b1764a62ffe965e6cbd1fca498acb371fbae898d76-pod wellcom-msa-app/radix-pif5fc0a030abc56991deb124ec1ce7567d8b4b8ba5173e24647b-pod wellcom-msa-app/radix-pif9242c4b143d737e5bc4c720bd62b7f8818414010a1154d9e1b-pod wellx-designer-master/frontend-aux-oauth-644bcdb8b-brqht wellx-designer-testing/frontend-aux-oauth-644bcdb8b-bffvb wellx-master/documentation-aux-oauth-5dd65779f8-qv6mp wellx-prod/documentation-aux-oauth-5dd65779f8-69sst wellx-testing/documentation-aux-oauth-5dd65779f8-hn6hc whoisappsec-single/web-aux-oauth-dff87b5ff-j7h7l winwind-prod/esa-aux-oauth-74d48775c6-j2f2m ....more wellcom-msa