Feature Request: Filter dropped caps

[jinankjain]

In the current situation kubeaudit just audit for the fact that any capability is dropped or not. It does not take into account any specific capability.

This feature will introduce a flag through which a user would be able to specify that which caps should be dropped necessarily. And kubeaudit will error if those caps are not dropped instead of just giving a warning.

What do you say @jonpulsifer @klautcomputing ?

[klautcomputing]

I am not sure about a flag in kubeaudit...

I think my preferred solution would be if you could put all the information in a label, e.g. kubeaudit.cap.allow = sys_chroot and then kubeaudit would not bug you about it because it knows that the capability is actually needed and should be set.

This would be a great way not only for capabilities but for everything else. There might be containers that need a read-write filesystem or need to run as root. And labels would give us the opportunity to actually make sure we don't complain about things that are legitimately not up to the tightest security standards.

[klautcomputing]

I am gonna start working on this.

[jinankjain]

Time to close this one with #73 @fedorlis