{
  "SchemaVersion": 2,
  "ReportID": "017b7d41-e09f-7000-80ea-000000000001",
  "CreatedAt": "2021-08-25T12:20:30.000000005Z",
  "ArtifactName": "testdata/fixtures/repo/helm",
  "ArtifactType": "repository",
  "Results": [
    {
      "Target": "testchart.tar.gz:templates/pod.yaml",
      "Class": "config",
      "Type": "helm",
      "MisconfSummary": {
        "Successes": 78,
        "Failures": 18
      },
      "Misconfigurations": [
        {
          "Type": "Helm Security Check",
          "ID": "KSV001",
          "AVDID": "AVD-KSV-0001",
          "Title": "Can elevate its own privileges",
          "Description": "A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node.",
          "Message": "Container 'nginx' of Deployment 'nginx-deployment' should set 'securityContext.allowPrivilegeEscalation' to false",
          "Namespace": "builtin.kubernetes.KSV001",
          "Query": "data.builtin.kubernetes.KSV001.deny",
          "Resolution": "Set 'set containers[].securityContext.allowPrivilegeEscalation' to 'false'.",
          "Severity": "MEDIUM",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv001",
          "References": [
            "https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted",
            "https://avd.aquasec.com/misconfig/ksv001"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV003",
          "AVDID": "AVD-KSV-0003",
          "Title": "Default capabilities: some containers do not drop all",
          "Description": "The container should drop all default capabilities and add only those that are needed for its execution.",
          "Message": "Container 'nginx' of Deployment 'nginx-deployment' should add 'ALL' to 'securityContext.capabilities.drop'",
          "Namespace": "builtin.kubernetes.KSV003",
          "Query": "data.builtin.kubernetes.KSV003.deny",
          "Resolution": "Add 'ALL' to containers[].securityContext.capabilities.drop.",
          "Severity": "LOW",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv003",
          "References": [
            "https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/",
            "https://avd.aquasec.com/misconfig/ksv003"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV004",
          "AVDID": "AVD-KSV-0004",
          "Title": "Default capabilities: some containers do not drop any",
          "Description": "Security best practices require containers to run with minimal required capabilities.",
          "Message": "Container 'nginx' of 'deployment' 'nginx-deployment' in 'default' namespace should set securityContext.capabilities.drop",
          "Namespace": "builtin.kubernetes.KSV004",
          "Query": "data.builtin.kubernetes.KSV004.deny",
          "Resolution": "Specify at least one unneeded capability in 'containers[].securityContext.capabilities.drop'",
          "Severity": "LOW",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv004",
          "References": [
            "https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/",
            "https://avd.aquasec.com/misconfig/ksv004"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV011",
          "AVDID": "AVD-KSV-0011",
          "Title": "CPU not limited",
          "Description": "Enforcing CPU limits prevents DoS via resource exhaustion.",
          "Message": "Container 'nginx' of Deployment 'nginx-deployment' should set 'resources.limits.cpu'",
          "Namespace": "builtin.kubernetes.KSV011",
          "Query": "data.builtin.kubernetes.KSV011.deny",
          "Resolution": "Set a limit value under 'containers[].resources.limits.cpu'.",
          "Severity": "LOW",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv011",
          "References": [
            "https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits",
            "https://avd.aquasec.com/misconfig/ksv011"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV012",
          "AVDID": "AVD-KSV-0012",
          "Title": "Runs as root user",
          "Description": "Force the running image to run as a non-root user to ensure least privileges.",
          "Message": "Container 'nginx' of Deployment 'nginx-deployment' should set 'securityContext.runAsNonRoot' to true",
          "Namespace": "builtin.kubernetes.KSV012",
          "Query": "data.builtin.kubernetes.KSV012.deny",
          "Resolution": "Set 'containers[].securityContext.runAsNonRoot' to true.",
          "Severity": "MEDIUM",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv012",
          "References": [
            "https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted",
            "https://avd.aquasec.com/misconfig/ksv012"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV014",
          "AVDID": "AVD-KSV-0014",
          "Title": "Root file system is not read-only",
          "Description": "An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.",
          "Message": "Container 'nginx' of Deployment 'nginx-deployment' should set 'securityContext.readOnlyRootFilesystem' to true",
          "Namespace": "builtin.kubernetes.KSV014",
          "Query": "data.builtin.kubernetes.KSV014.deny",
          "Resolution": "Change 'containers[].securityContext.readOnlyRootFilesystem' to 'true'.",
          "Severity": "HIGH",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv014",
          "References": [
            "https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/",
            "https://avd.aquasec.com/misconfig/ksv014"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV015",
          "AVDID": "AVD-KSV-0015",
          "Title": "CPU requests not specified",
          "Description": "When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.",
          "Message": "Container 'nginx' of Deployment 'nginx-deployment' should set 'resources.requests.cpu'",
          "Namespace": "builtin.kubernetes.KSV015",
          "Query": "data.builtin.kubernetes.KSV015.deny",
          "Resolution": "Set 'containers[].resources.requests.cpu'.",
          "Severity": "LOW",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv015",
          "References": [
            "https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits",
            "https://avd.aquasec.com/misconfig/ksv015"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV016",
          "AVDID": "AVD-KSV-0016",
          "Title": "Memory requests not specified",
          "Description": "When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.",
          "Message": "Container 'nginx' of Deployment 'nginx-deployment' should set 'resources.requests.memory'",
          "Namespace": "builtin.kubernetes.KSV016",
          "Query": "data.builtin.kubernetes.KSV016.deny",
          "Resolution": "Set 'containers[].resources.requests.memory'.",
          "Severity": "LOW",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv016",
          "References": [
            "https://kubesec.io/basics/containers-resources-limits-memory/",
            "https://avd.aquasec.com/misconfig/ksv016"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV018",
          "AVDID": "AVD-KSV-0018",
          "Title": "Memory not limited",
          "Description": "Enforcing memory limits prevents DoS via resource exhaustion.",
          "Message": "Container 'nginx' of Deployment 'nginx-deployment' should set 'resources.limits.memory'",
          "Namespace": "builtin.kubernetes.KSV018",
          "Query": "data.builtin.kubernetes.KSV018.deny",
          "Resolution": "Set a limit value under 'containers[].resources.limits.memory'.",
          "Severity": "LOW",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv018",
          "References": [
            "https://kubesec.io/basics/containers-resources-limits-memory/",
            "https://avd.aquasec.com/misconfig/ksv018"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV020",
          "AVDID": "AVD-KSV-0020",
          "Title": "Runs with UID \u003c= 10000",
          "Description": "Force the container to run with user ID \u003e 10000 to avoid conflicts with the host’s user table.",
          "Message": "Container 'nginx' of Deployment 'nginx-deployment' should set 'securityContext.runAsUser' \u003e 10000",
          "Namespace": "builtin.kubernetes.KSV020",
          "Query": "data.builtin.kubernetes.KSV020.deny",
          "Resolution": "Set 'containers[].securityContext.runAsUser' to an integer \u003e 10000.",
          "Severity": "LOW",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv020",
          "References": [
            "https://kubesec.io/basics/containers-securitycontext-runasuser/",
            "https://avd.aquasec.com/misconfig/ksv020"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV021",
          "AVDID": "AVD-KSV-0021",
          "Title": "Runs with GID \u003c= 10000",
          "Description": "Force the container to run with group ID \u003e 10000 to avoid conflicts with the host’s user table.",
          "Message": "Container 'nginx' of Deployment 'nginx-deployment' should set 'securityContext.runAsGroup' \u003e 10000",
          "Namespace": "builtin.kubernetes.KSV021",
          "Query": "data.builtin.kubernetes.KSV021.deny",
          "Resolution": "Set 'containers[].securityContext.runAsGroup' to an integer \u003e 10000.",
          "Severity": "LOW",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv021",
          "References": [
            "https://kubesec.io/basics/containers-securitycontext-runasuser/",
            "https://avd.aquasec.com/misconfig/ksv021"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV030",
          "AVDID": "AVD-KSV-0030",
          "Title": "Runtime/Default Seccomp profile not set",
          "Description": "According to pod security standard 'Seccomp', the RuntimeDefault seccomp profile must be required, or allow specific additional profiles.",
          "Message": "Either Pod or Container should set 'securityContext.seccompProfile.type' to 'RuntimeDefault'",
          "Namespace": "builtin.kubernetes.KSV030",
          "Query": "data.builtin.kubernetes.KSV030.deny",
          "Resolution": "Set 'spec.securityContext.seccompProfile.type', 'spec.containers[*].securityContext.seccompProfile' and 'spec.initContainers[*].securityContext.seccompProfile' to 'RuntimeDefault' or undefined.",
          "Severity": "LOW",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv030",
          "References": [
            "https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted",
            "https://avd.aquasec.com/misconfig/ksv030"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV104",
          "AVDID": "AVD-KSV-0104",
          "Title": "Seccomp policies disabled",
          "Description": "A program inside the container can bypass Seccomp protection policies.",
          "Message": "container \"nginx\" of deployment \"nginx-deployment\" in \"default\" namespace should specify a seccomp profile",
          "Namespace": "builtin.kubernetes.KSV104",
          "Query": "data.builtin.kubernetes.KSV104.deny",
          "Resolution": "Specify seccomp either by annotation or by seccomp profile type having allowed values as per pod security standards",
          "Severity": "MEDIUM",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv104",
          "References": [
            "https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline",
            "https://avd.aquasec.com/misconfig/ksv104"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV106",
          "AVDID": "AVD-KSV-0106",
          "Title": "Container capabilities must only include NET_BIND_SERVICE",
          "Description": "Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.",
          "Message": "container should drop all",
          "Namespace": "builtin.kubernetes.KSV106",
          "Query": "data.builtin.kubernetes.KSV106.deny",
          "Resolution": "Set 'spec.containers[*].securityContext.capabilities.drop' to 'ALL' and only add 'NET_BIND_SERVICE' to 'spec.containers[*].securityContext.capabilities.add'.",
          "Severity": "LOW",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv106",
          "References": [
            "https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted",
            "https://avd.aquasec.com/misconfig/ksv106"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV110",
          "AVDID": "AVD-KSV-0110",
          "Title": "Workloads in the default namespace",
          "Description": "Checks whether a workload is running in the default namespace.",
          "Message": "deployment nginx-deployment in default namespace should set metadata.namespace to a non-default namespace",
          "Namespace": "builtin.kubernetes.KSV110",
          "Query": "data.builtin.kubernetes.KSV110.deny",
          "Resolution": "Set 'metadata.namespace' to a non-default namespace.",
          "Severity": "LOW",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv110",
          "References": [
            "https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/",
            "https://avd.aquasec.com/misconfig/ksv110"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 4,
            "EndLine": 7,
            "Code": {
              "Lines": [
                {
                  "Number": 4,
                  "Content": "metadata:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "\u001b[38;5;33mmetadata\u001b[0m:",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 5,
                  "Content": "  name: nginx-deployment",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "  \u001b[38;5;33mname\u001b[0m: nginx-deployment",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 6,
                  "Content": "  labels:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "  \u001b[38;5;33mlabels\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 7,
                  "Content": "    app: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "    \u001b[38;5;33mapp\u001b[0m: nginx",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV117",
          "AVDID": "AVD-KSV-0117",
          "Title": "Prevent binding to privileged ports",
          "Description": "The ports which are lower than 1024 receive and transmit various sensitive and privileged data. Allowing containers to use them can bring serious implications.",
          "Message": "deployment nginx-deployment in default namespace should not set spec.template.spec.containers.ports.containerPort to less than 1024",
          "Namespace": "builtin.kubernetes.KSV117",
          "Query": "data.builtin.kubernetes.KSV117.deny",
          "Resolution": "Do not map the container ports to privileged host ports when starting a container.",
          "Severity": "MEDIUM",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv117",
          "References": [
            "https://kubernetes.io/docs/concepts/security/pod-security-standards/",
            "https://www.stigviewer.com/stig/kubernetes/2022-12-02/finding/V-242414",
            "https://avd.aquasec.com/misconfig/ksv117"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general"
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV118",
          "AVDID": "AVD-KSV-0118",
          "Title": "Default security context configured",
          "Description": "Security context controls the allocation of security parameters for the pod/container/volume, ensuring the appropriate level of protection. Relying on default security context may expose vulnerabilities to potential attacks that rely on privileged access.",
          "Message": "container nginx-deployment in default namespace is using the default security context",
          "Namespace": "builtin.kubernetes.KSV118",
          "Query": "data.builtin.kubernetes.KSV118.deny",
          "Resolution": "To enhance security, it is strongly recommended not to rely on the default security context. Instead, it is advisable to explicitly define the required security parameters (such as runAsNonRoot, capabilities, readOnlyRootFilesystem, etc.) within the security context.",
          "Severity": "HIGH",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv118",
          "References": [
            "https://kubernetes.io/docs/tasks/configure-pod-container/security-context/",
            "https://avd.aquasec.com/misconfig/ksv118"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 19,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        },
        {
          "Type": "Helm Security Check",
          "ID": "KSV118",
          "AVDID": "AVD-KSV-0118",
          "Title": "Default security context configured",
          "Description": "Security context controls the allocation of security parameters for the pod/container/volume, ensuring the appropriate level of protection. Relying on default security context may expose vulnerabilities to potential attacks that rely on privileged access.",
          "Message": "deployment nginx-deployment in default namespace is using the default security context, which allows root privileges",
          "Namespace": "builtin.kubernetes.KSV118",
          "Query": "data.builtin.kubernetes.KSV118.deny",
          "Resolution": "To enhance security, it is strongly recommended not to rely on the default security context. Instead, it is advisable to explicitly define the required security parameters (such as runAsNonRoot, capabilities, readOnlyRootFilesystem, etc.) within the security context.",
          "Severity": "HIGH",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv118",
          "References": [
            "https://kubernetes.io/docs/tasks/configure-pod-container/security-context/",
            "https://avd.aquasec.com/misconfig/ksv118"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Kubernetes",
            "Service": "general",
            "StartLine": 17,
            "EndLine": 22,
            "Code": {
              "Lines": [
                {
                  "Number": 17,
                  "Content": "    spec:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "    \u001b[38;5;33mspec\u001b[0m:",
                  "FirstCause": true,
                  "LastCause": false
                },
                {
                  "Number": 18,
                  "Content": "      containers:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      \u001b[38;5;33mcontainers\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 19,
                  "Content": "      - name: nginx",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "      - \u001b[38;5;33mname\u001b[0m: nginx",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 20,
                  "Content": "        image: nginx:1.14.2",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mimage\u001b[0m: nginx:1.14.2",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 21,
                  "Content": "        ports:",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        \u001b[38;5;33mports\u001b[0m:",
                  "FirstCause": false,
                  "LastCause": false
                },
                {
                  "Number": 22,
                  "Content": "        - containerPort: 80",
                  "IsCause": true,
                  "Annotation": "",
                  "Truncated": false,
                  "Highlighted": "        - \u001b[38;5;33mcontainerPort\u001b[0m: \u001b[38;5;37m80\u001b[0m",
                  "FirstCause": false,
                  "LastCause": true
                }
              ]
            }
          }
        }
      ]
    }
  ]
}
