search

knative / serving-operator

DEPRECATED: Development continues in https://github.com/knative/operator/
Apache License 2.0
39 stars 48 forks source link

Security: Please set pod Security Context on all Pods #384

Closed AceHack closed 4 years ago

AceHack commented 4 years ago

Many companies have a security requirement in place that all pods must not run as root and set the run as user. Please set this (Or allow it to be set) on all pods. This would mean either adding it yourself or adding it to any CRDs that end up creating pods so the user can set it. Note this is at the pod level, not the container level. I will be creating a separate feature request for the container security content.

https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

See the pod security context example below for what is required to be set.

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000

Related Feature Request: https://github.com/knative/eventing/issues/2881

evankanderson commented 4 years ago

We're going to track this in https://github.com/knative-sandbox/operator/issues/3 and address it comprehensively rather than on a per-repo basis.

/close

knative-prow-robot commented 4 years ago

@evankanderson: Closing this issue.

In response to [this](https://github.com/knative/serving-operator/issues/384#issuecomment-610509517): >We're going to track this in https://github.com/knative-sandbox/operator/issues/3 and address it comprehensively rather than on a per-repo basis. > >/close Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.