mirror of
https://github.com/FairwindsOps/polaris.git
synced 2026-05-08 10:16:43 +00:00
1ede736971
* update notReadOnlyRootFilesystem check * remove run as user * add pod level testing to notreadonlyrootFileSystem and update schema_test.go file Co-authored-by: Robert Brennan <accounts@rbren.io>
43 lines
1.0 KiB
YAML
43 lines
1.0 KiB
YAML
successMessage: Filesystem is read only
|
|
failureMessage: Filesystem should be read only
|
|
category: Security
|
|
target: Container
|
|
schemaTarget: Pod
|
|
schema:
|
|
'$schema': http://json-schema.org/draft-07/schema
|
|
definitions:
|
|
goodSecurityContext:
|
|
type: object
|
|
anyOf:
|
|
- required:
|
|
- readOnlyRootFilesystem
|
|
properties:
|
|
readOnlyRootFilesystem:
|
|
const: true
|
|
notBadSecurityContext:
|
|
type: object
|
|
properties:
|
|
readOnlyRootFilesystem:
|
|
const: true
|
|
type: object
|
|
anyOf:
|
|
- required:
|
|
- securityContext
|
|
properties:
|
|
securityContext:
|
|
$ref: "#/definitions/goodSecurityContext"
|
|
containers:
|
|
type: array
|
|
items:
|
|
properties:
|
|
securityContext:
|
|
$ref: "#/definitions/notBadSecurityContext"
|
|
- properties:
|
|
containers:
|
|
type: array
|
|
items:
|
|
required:
|
|
- securityContext
|
|
properties:
|
|
securityContext:
|
|
$ref: "#/definitions/goodSecurityContext" |