Details
-
Bug
-
Resolution: Done-Errata
-
Normal
-
None
-
4.12
-
None
-
Moderate
-
2
-
CMP Sprint 70
-
1
-
False
-
Description
Description of problem:
oc-compliance should comply to restricted pod security level
Version-Release number of selected component (if applicable):
4.11.0-rc.1
How reproducible:
Always
Steps to Reproduce:
1. oc compliance fetch-raw scansettingbinding nist-moderate -o resultsdir/
Actual results:
W1003 08:06:07.360522 18102 warnings.go:70] would violate PodSecurity "restricted:latest": host namespaces (hostNetwork=true, hostPID=true), privileged (container "container-00" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container "container-00" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "container-00" must set securityContext.capabilities.drop=["ALL"]), restricted volume types (volume "host" uses restricted volume type "hostPath"), runAsNonRoot != true (pod or container "container-00" must set securityContext.runAsNonRoot=true), runAsUser=0 (container "container-00" must not set runAsUser=0), seccompProfile (pod or container "container-00" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
Expected results:
The pod should be launched without the issue warnings
Additional info:
Attachments
Issue Links
- links to
-
RHBA-2023:5155
OpenShift Container Platform 4.13.z bug fix update
-
RHEA-2023:5177
oc-compliance enhancement update
- mentioned on
