security(coredns): disposition the required DNS bind capability

[devantler]

🤖 Generated by the Agentic Engineer

Outcome

Disposition the three scanner findings caused by CoreDNS binding the required DNS service port without weakening the rest of the repository scan.

Parent

First control-family slice of #2787.

Current evidence

• Checkov reports CKV_K8S_25 once on the Docker CoreDNS Deployment.
• Trivy reports KSV-0022 and KSV-0117 once each on the same Deployment.
• The pinned distroless CoreDNS image runs as UID/GID 65532 and its binary carries the file capability needed for port 53; the container needs only NET_BIND_SERVICE in its bounding set and drops all other capabilities.

Acceptance criteria

• Add a resource-scoped Checkov disposition for CKV_K8S_25 with the verified port-53 reason.
• Add path-scoped Trivy dispositions for KSV-0022 and KSV-0117 on only the CoreDNS Deployment.
• Keep the same checks active for every other repository path.
• Reproduce the CI-equivalent counts: Checkov 9 to 8 and Trivy 110 to 108.
• Both local and production workload validations remain green.

Out of scope

CPU limit, trusted-registry, and other remaining CoreDNS findings stay in #2787 for separate disposition or remediation.

[coderabbitai]

🔗 Related PRs

#2900 - security(k8s): withdraw the CKV_K8S_40 suppressions whose reasons do not hold [merged]
#2911 - fix(security): disposition the three unconstrained CKV_K8S_40 sites [merged]
#3017 - fix(security): disposition the six unreachable-probe checkov findings [merged]
#3051 - security(k8s): scope the vault-config low UID to the openbao containers [merged]
#3054 - fix(security): scope trivy KSV-0037 to the infrastructure trees [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!