Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add runAsNonRoot annotation to the kube-rbac-proxy
A static analysis (SAST) has detected potential bug(s) or issue(s) within the manila-operator: Error: SIGMA.container_running_as_root (CWE-269): unpacked_remote_sources/app/config/default/manager_auth_proxy_patch.yaml:14: Sigma main event: The Kubernetes container is allowed to run as the root user. This may allow attackers to gain the root privileges of the host when the container is compromised. unpacked_remote_sources/app/config/default/manager_auth_proxy_patch.yaml:14: remediation: Explicitly set the `securityContext.runAsNonRoot` value to `true` to prevent the container from running as a root-level user. kube-rbac-proxy does run rootless by default [1][2]; however, this annotation shouldn't hurt in case the underlying container image changes in the future. Jira: OSPRH-9115 [1] https://github.com/brancz/kube-rbac-proxy/blob/b76470f11760731a6ddb6977cd11ac25929ed0a0/Dockerfile#L9C6-L9C11 [2] operator-framework/operator-sdk#4498 (cherry picked from commit 6c1ed08)
- Loading branch information