fix(kubernetes): validate seccomp profile at pod and container levels #5814
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Context
The issue highlights an incorrect validation in Prowler's Kubernetes check for ensuring that the
docker/default
seccomp profile is enabled in pods. The validation incorrectly flags pods withseccompProfile.type: RuntimeDefault
as failing, despite this configuration being compliant.The problem arises because the check does not fully account for cases where the
RuntimeDefault
profile is correctly set in thesecurityContext
in the pod containers.Fix #5803
Description
This PR updates the
core_seccomp_profile_docker_default
check to properly validate the seccomp profile at both the pod and container levels. The new implementation ensures:securityContext.seccompProfile.type: RuntimeDefault
.securityContext.seccompProfile.type: RuntimeDefault
.Checklist
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.