Skip to content

Add SAST Kubesec scanner workflow and related manifests #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
CalinL merged 1 commit into from
Apr 21, 2025

Add SAST Kubesec scanner workflow and related manifests

3fd24d1
Select commit
Loading
Failed to load commit list.
Merged

Add SAST Kubesec scanner workflow and related manifests #22

Add SAST Kubesec scanner workflow and related manifests
3fd24d1
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / checkov failed Apr 21, 2025 in 3s

36 new alerts including 6 errors

New alerts in code changed by this pull request

  • 6 errors
  • 30 notes

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Containers should not run with allowPrivilegeEscalation Error

Containers should not run with allowPrivilegeEscalation

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

CPU limits should be set Note

CPU limits should be set

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

CPU requests should be set Note

CPU requests should be set

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

The default namespace should not be used Note

The default namespace should not be used

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Minimize the admission of containers with the NET_RAW capability Note

Minimize the admission of containers with the NET_RAW capability

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Image should use digest Note

Image should use digest

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Image Pull Policy should be Always Note

Image Pull Policy should be Always

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Liveness Probe Should be Configured Note

Liveness Probe Should be Configured

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Memory limits should be set Note

Memory limits should be set

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Memory requests should be set Note

Memory requests should be set

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Minimize the admission of containers with capabilities assigned Note

Minimize the admission of containers with capabilities assigned

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Apply security context to your pods and containers Note

Apply security context to your pods and containers

Check failure on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Container should not be privileged Error

Container should not be privileged

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Readiness Probe Should be Configured Note

Readiness Probe Should be Configured

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Use read-only filesystem for containers where possible Note

Use read-only filesystem for containers where possible

Check failure on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Minimize the admission of root containers Error

Minimize the admission of root containers

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Containers should run as a high UID to avoid host conflict Note

Containers should run as a high UID to avoid host conflict

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Ensure that the seccomp profile is set to docker/default or runtime/default Note

Ensure that the seccomp profile is set to docker/default or runtime/default

Check notice on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Ensure that Service Account Tokens are only mounted where necessary Note

Ensure that Service Account Tokens are only mounted where necessary

Check failure on line 11 in manifests/critical-double.yaml

See this annotation in the file changed.

Code scanning / checkov

Minimize the admission of pods which lack an associated NetworkPolicy Error

Minimize the admission of pods which lack an associated NetworkPolicy

Check failure on line 15 in manifests/score-5-pod-serviceaccount.yaml

See this annotation in the file changed.

Code scanning / checkov

Containers should not run with allowPrivilegeEscalation Error

Containers should not run with allowPrivilegeEscalation

Check notice on line 15 in manifests/score-5-pod-serviceaccount.yaml

See this annotation in the file changed.

Code scanning / checkov

CPU limits should be set Note

CPU limits should be set

Check notice on line 15 in manifests/score-5-pod-serviceaccount.yaml

See this annotation in the file changed.

Code scanning / checkov

CPU requests should be set Note

CPU requests should be set

Check notice on line 15 in manifests/score-5-pod-serviceaccount.yaml

See this annotation in the file changed.

Code scanning / checkov

The default namespace should not be used Note

The default namespace should not be used

Check notice on line 15 in manifests/score-5-pod-serviceaccount.yaml

See this annotation in the file changed.

Code scanning / checkov

Minimize the admission of containers with the NET_RAW capability Note

Minimize the admission of containers with the NET_RAW capability