Description

Identifies Kubernetes container configurations that are missing security context settings. Missing security contexts can allow containers to run with excessive privileges, potentially enabling privilege escalation attacks or container breakouts.

Detection Strategy

• Examines Kubernetes resource definitions in infrastructure code (like pod specs, deployments, etc)

• Checks if container specifications are present under the 'spec' field

• Verifies if securityContext configuration is missing from container specifications

• Reports containers that don't have security context constraints defined

Vulnerable code example

# Vulnerable Kubernetes pod configuration
resource "kubernetes_pod" "example" {
  metadata {
    name = "vulnerable-pod"
    labels = {
      app = "web"
    }
  }...

✅ Secure code example

resource "kubernetes_pod" "example" {
  metadata {
    name = "vulnerable-pod"
    labels = {
      app = "web"
    }
  }
  spec {...