The admission control plugin SecurityContextDeny is set if PodSecurityPolicy is used misconfiguratio

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_81
Category - Subcategory	Kubernetes - Native Security Controls
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize

Impact

The SecurityContextDeny admission controller can be used to deny pods which make use of some SecurityContext fields which could allow for privilege escalation in the cluster. This should be used where PodSecurityPolicy is not in place within the cluster. SecurityContextDeny can be used to provide a layer of security for clusters which do not have PodSecurityPolicies enabled.

How to Fix

Kind: Pod [source,go]

{ "apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers:

• command:
• • kube-apiserver
• • --enable-admission-plugins=SecurityContextDeny image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 ...", }

---