Update deployment.yaml #2
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -43,3 +43,37 @@ spec: | |
| targetPort: 80 | ||
| selector: | ||
| app: health-check | ||
| --- | ||
| apiVersion: apps/v1 | ||
|
There was a problem hiding this comment. Error Description: Apply security context to your pods and containers There was a problem hiding this comment. Error Description: Minimize the admission of root containers There was a problem hiding this comment. Error Description: Containers should run as a high UID to avoid host conflict There was a problem hiding this comment. Error Description: Ensure that the seccomp profile is set to docker/default or runtime/default There was a problem hiding this comment. Error Description: Ensure that Service Account Tokens are only mounted where necessary |
||
| kind: Deployment | ||
| metadata: | ||
| name: my-deployment | ||
| spec: | ||
| selector: | ||
| matchLabels: | ||
| app: deploy | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app: deploy | ||
| spec: | ||
| containers: | ||
| - name: health-check | ||
|
There was a problem hiding this comment. Error Description: Containers should not run with allowPrivilegeEscalation There was a problem hiding this comment. Error Description: CPU requests should be set There was a problem hiding this comment. Error Description: Minimize the admission of containers with the NET_RAW capability There was a problem hiding this comment. Error Description: Image should use digest There was a problem hiding this comment. Error Description: Image Tag should be fixed - not latest or blank There was a problem hiding this comment. Error Description: Liveness Probe Should be Configured There was a problem hiding this comment. Error Description: Memory requests should be set There was a problem hiding this comment. Error Description: Minimize the admission of containers with capabilities assigned There was a problem hiding this comment. Error Description: Container should not be privileged There was a problem hiding this comment. Error Description: Use read-only filesystem for containers where possible There was a problem hiding this comment. Error Description: Readiness Probe Should be Configured |
||
| image: madhuakula/k8s-goat-health-check:latest | ||
| resources: | ||
| limits: | ||
| memory: "100Mi" | ||
| cpu: "30m" | ||
| ports: | ||
| - containerPort: 80 | ||
| # Custom Stuff | ||
| securityContext: | ||
| privileged: true | ||
| volumeMounts: | ||
| - mountPath: /custom/docker/docker.sock | ||
| name: docker-sock-volume | ||
| volumes: | ||
| - name: docker-sock-volume | ||
| hostPath: | ||
| path: /var/run/docker.sock | ||
| type: File | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Error Description: Do not expose the docker daemon socket to containers
Category: Kubernetes | Severity: MEDIUM
Resource: Deployment [my-deployment], lines: 47 - 79