polaris/docs/check-documentation/security.md

Security

Polaris supports a number of checks related to security.

key	default	description
security.hostIPCSet	danger	Fails when hostIPC attribute is configured.
security.hostPIDSet	danger	Fails when hostPID attribute is configured.
security.notReadOnlyRootFilesystem	warning	Fails when securityContext.readOnlyRootFilesystem is not true.
security.privilegeEscalationAllowed	danger	Fails when securityContext.allowPrivilegeEscalation is true.
security.runAsRootAllowed	danger	Fails when securityContext.runAsNonRoot is not true.
security.runAsPrivileged	danger	Fails when securityContext.privileged is true.

Security Capabilities

Additional validations are available to ensure pods are running with a limited set of capabilities. More information is available in our Security Capabilities documentation.

Background

Securing workloads in Kubernetes is an important part of overall cluster security. The overall goal should be to ensure that containers are running with as minimal privileges as possible. This includes avoiding privilege escalation, not running containers with a root user, and using read only file systems wherever possible.

Much of this configuration can be found in the securityContext attribute for both Kubernetes pods and containers. Where configuration is available at both a pod and container level, Polaris validates both.

Further Reading

• Kubernetes Docs: Configure a Security Context for a Pod or Container
• KubeCon 2018 Keynote: Running with Scissors
• Kubernetes Security Book