mirror of
https://github.com/FairwindsOps/polaris.git
synced 2026-08-23 22:26:34 +00:00
jdesouza
2b17c31957
* Bump lins * Code refactoring * Fixign issues * Fixing issues * Fixing issues * Fixing issues * [WIP] * [WIP] * [WIP] * Trying to fix tests * Trying to fix tests * Fixing issues * Fixing issues * Fixing issues * Fixing issues * Fixing issues * Fixing issues * Revert go mod * Revert go mod * Revert go mod * Revert go mod * Fixing issues * Fixing issue * Code refactoring * Updating json schema version * Updating json schema version
57 lines
1.3 KiB
YAML
57 lines
1.3 KiB
YAML
successMessage: Is not allowed to run as root
|
|
failureMessage: Should not be allowed to run as root
|
|
category: Security
|
|
target: Container
|
|
schemaTarget: PodSpec
|
|
schema:
|
|
'$schema': https://json-schema.org/draft/2019-09/schema
|
|
$defs:
|
|
goodSecurityContext:
|
|
type: object
|
|
anyOf:
|
|
- required:
|
|
- runAsUser
|
|
properties:
|
|
runAsUser:
|
|
minimum: 1
|
|
- required:
|
|
- runAsNonRoot
|
|
properties:
|
|
runAsNonRoot:
|
|
const: true
|
|
notBadSecurityContext:
|
|
type: object
|
|
properties:
|
|
runAsUser:
|
|
minimum: 1
|
|
runAsNonRoot:
|
|
const: true
|
|
type: object
|
|
anyOf:
|
|
# non-root specified at pod-level, and not overridden at container level
|
|
- required:
|
|
- securityContext
|
|
properties:
|
|
securityContext:
|
|
$ref: "#/$defs/goodSecurityContext"
|
|
containers:
|
|
type: array
|
|
items:
|
|
properties:
|
|
securityContext:
|
|
$ref: "#/$defs/notBadSecurityContext"
|
|
# non-root specified at container level
|
|
- properties:
|
|
containers:
|
|
type: array
|
|
items:
|
|
required:
|
|
- securityContext
|
|
properties:
|
|
securityContext:
|
|
$ref: "#/$defs/goodSecurityContext"
|
|
mutations:
|
|
- op: add
|
|
path: /securityContext/runAsNonRoot
|
|
value: true
|