Security: Please set pod Security Context on all Pods

[AceHack]

Many companies have a security requirement in place that all pods must not run as root and set the run as user. Please set this (Or allow it to be set) on all pods. This would mean either adding it yourself or adding it to any CRDs that end up creating pods so the user can set it. Note this is at the pod level, not the container level. I will be creating a separate feature request for the container security content.

https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

See the pod security context example below for what is required to be set.

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000

Related Feature Request: knative/eventing#2881

[evankanderson]

Context:

• It turns out that Twistlock scans and flags pods and containers running without these settings even if the underlying container has these set in the Docker manifest.
• ko will create docker images as non-root users with a minimal filesystem that the user doesn't have write access to (except perhaps /var/log).
• Given the popularity of Twistlock, it may be worth filing an issue against them but also worth repeating these container settings in our YAML for the system pods that we ship.

Random thought: it would be cool to have something which could extract these from a registry and mirror them to Kubernetes. Much simpler than that is to have a test that these are set in the
operator tests.

[AceHack]

We found
https://kubernetes.io/docs/concepts/policy/pod-security-policy/
But again twist lock does not seem to scan deep enough to detect these settings as of yet

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

[AceHack]

/remove-lifecycle stale

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

[AceHack]

Bump

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.