Repository: cdk8s-team/cdk8s-plus
Pull request #1144 (2022-09-14 04:46:49)

feat(container): `allowPrivilegeEscalation` property 
`allowPrivilegeEscalation` controls whether a process can gain more privileges than its parent process. Currently, we were not explicitly setting this. To align with best practices, we are now setting this to `false`.

Signed-off-by: Vinayak Kukreja <vinakuk@amazon.com>

Resolves https://github.com/cdk8s-team/cdk8s-plus/issues/816


Patch:
diff --git a/src/container.ts b/src/container.ts
index 11fc6327..a10fd9ab 100644
--- a/src/container.ts
+++ b/src/container.ts
@@ -53,6 +53,12 @@ export interface ContainerSecurityContextProps {
    */
   readonly readOnlyRootFilesystem?: boolean;
 
+  /**
+   * Whether a process can gain more privileges than its parent process.
+   *
+   * @default false
+   */
+  readonly allowPrivilegeEscalation?: boolean;
 }
 
 /**
@@ -130,6 +136,7 @@ export class ContainerSecurityContext {
   public readonly readOnlyRootFilesystem: boolean;
   public readonly user?: number;
   public readonly group?: number;
+  public readonly allowPrivilegeEscalation?: boolean;
 
   constructor(props: ContainerSecurityContextProps = {}) {
     this.ensureNonRoot = props.ensureNonRoot ?? true;
@@ -137,6 +144,7 @@ export class ContainerSecurityContext {
     this.readOnlyRootFilesystem = props.readOnlyRootFilesystem ?? true;
     this.user = props.user ?? 25000;
     this.group = props.group ?? 26000;
+    this.allowPrivilegeEscalation = props.allowPrivilegeEscalation ?? false;
   }
 
   /**
@@ -149,6 +157,7 @@ export class ContainerSecurityContext {
       runAsNonRoot: this.ensureNonRoot,
       privileged: this.privileged,
       readOnlyRootFilesystem: this.readOnlyRootFilesystem,
+      allowPrivilegeEscalation: this.allowPrivilegeEscalation,
     };
   }
 
@@ -639,6 +648,9 @@ export interface ContainerProps {
    *   ensureNonRoot: true
    *   privileged: false
    *   readOnlyRootFilesystem: true
+   *   allowPrivilegeEscalation: false
+   *   user: 25000
+   *   group: 26000
    */
   readonly securityContext?: ContainerSecurityContextProps;
 }


Test patch:
diff --git a/test/__snapshots__/container.test.ts.snap b/test/__snapshots__/container.test.ts.snap
index 4af78c31..40e090cc 100644
--- a/test/__snapshots__/container.test.ts.snap
+++ b/test/__snapshots__/container.test.ts.snap
@@ -34,6 +34,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -89,6 +90,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -152,6 +154,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -208,6 +211,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
diff --git a/test/__snapshots__/cron-job.test.ts.snap b/test/__snapshots__/cron-job.test.ts.snap
index 8e392df6..6ee06ee5 100644
--- a/test/__snapshots__/cron-job.test.ts.snap
+++ b/test/__snapshots__/cron-job.test.ts.snap
@@ -39,6 +39,7 @@ Array [
                     },
                   },
                   "securityContext": Object {
+                    "allowPrivilegeEscalation": false,
                     "privileged": false,
                     "readOnlyRootFilesystem": true,
                     "runAsGroup": 26000,
@@ -105,6 +106,7 @@ Array [
                     },
                   },
                   "securityContext": Object {
+                    "allowPrivilegeEscalation": false,
                     "privileged": false,
                     "readOnlyRootFilesystem": true,
                     "runAsGroup": 26000,
diff --git a/test/__snapshots__/daemon-set.test.ts.snap b/test/__snapshots__/daemon-set.test.ts.snap
index 14725f68..359276b2 100644
--- a/test/__snapshots__/daemon-set.test.ts.snap
+++ b/test/__snapshots__/daemon-set.test.ts.snap
@@ -39,6 +39,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -100,6 +101,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
diff --git a/test/__snapshots__/deployment.test.ts.snap b/test/__snapshots__/deployment.test.ts.snap
index e0a5868a..019007b5 100644
--- a/test/__snapshots__/deployment.test.ts.snap
+++ b/test/__snapshots__/deployment.test.ts.snap
@@ -53,6 +53,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -186,6 +187,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -286,6 +288,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -383,6 +386,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -474,6 +478,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -563,6 +568,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -633,6 +639,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -715,6 +722,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -785,6 +793,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -864,6 +873,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -956,6 +966,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -1045,6 +1056,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -1115,6 +1127,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -1197,6 +1210,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -1267,6 +1281,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -1346,6 +1361,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -1438,6 +1454,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -1527,6 +1544,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -1614,6 +1632,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -1698,6 +1717,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -1749,6 +1769,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
diff --git a/test/__snapshots__/network-policy.test.ts.snap b/test/__snapshots__/network-policy.test.ts.snap
index 7771069d..cd4552ff 100644
--- a/test/__snapshots__/network-policy.test.ts.snap
+++ b/test/__snapshots__/network-policy.test.ts.snap
@@ -121,6 +121,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -165,6 +166,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -250,6 +252,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -313,6 +316,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -400,6 +404,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -482,6 +487,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -563,6 +569,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -649,6 +656,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -743,6 +751,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -833,6 +842,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -937,6 +947,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1022,6 +1033,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1108,6 +1120,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1152,6 +1165,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1237,6 +1251,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1300,6 +1315,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -1387,6 +1403,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1469,6 +1486,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1550,6 +1568,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1636,6 +1655,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1730,6 +1750,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1820,6 +1841,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1924,6 +1946,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -2009,6 +2032,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -2095,6 +2119,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -2177,6 +2202,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
diff --git a/test/__snapshots__/pod.test.ts.snap b/test/__snapshots__/pod.test.ts.snap
index 0567e45b..72e2aee6 100644
--- a/test/__snapshots__/pod.test.ts.snap
+++ b/test/__snapshots__/pod.test.ts.snap
@@ -53,6 +53,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -164,6 +165,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -219,6 +221,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -294,6 +297,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -343,6 +347,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -418,6 +423,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -467,6 +473,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -588,6 +595,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -643,6 +651,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -718,6 +727,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -767,6 +777,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -842,6 +853,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -891,6 +903,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -994,6 +1007,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1072,6 +1086,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1189,6 +1204,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1295,6 +1311,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1344,6 +1361,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1469,6 +1487,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -1520,6 +1539,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1688,6 +1708,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1732,6 +1753,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1781,6 +1803,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -1891,6 +1914,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -2010,6 +2034,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -2059,6 +2084,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -2220,6 +2246,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -2331,6 +2358,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -2434,6 +2462,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -2512,6 +2541,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -2629,6 +2659,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -2745,6 +2776,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -2794,6 +2826,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -2919,6 +2952,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -2970,6 +3004,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -3138,6 +3173,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -3182,6 +3218,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -3231,6 +3268,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -3341,6 +3379,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -3460,6 +3499,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -3509,6 +3549,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -3670,6 +3711,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -3781,6 +3823,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -3830,6 +3873,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -3923,6 +3967,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -4024,6 +4069,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -4117,6 +4163,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -4205,6 +4252,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -4254,6 +4302,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -4361,6 +4410,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
@@ -4522,6 +4572,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -4592,6 +4643,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -4660,6 +4712,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -4709,6 +4762,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -4770,6 +4824,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -4819,6 +4874,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -4877,6 +4933,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -4943,6 +5000,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -5007,6 +5065,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -5056,6 +5115,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -5117,6 +5177,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -5166,6 +5227,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -5224,6 +5286,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -5290,6 +5353,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -5361,6 +5425,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
@@ -5410,6 +5475,7 @@ Array [
             },
           },
           "securityContext": Object {
+            "allowPrivilegeEscalation": false,
             "privileged": false,
             "readOnlyRootFilesystem": true,
             "runAsGroup": 26000,
diff --git a/test/__snapshots__/service.test.ts.snap b/test/__snapshots__/service.test.ts.snap
index c3caef62..faaaa8c3 100644
--- a/test/__snapshots__/service.test.ts.snap
+++ b/test/__snapshots__/service.test.ts.snap
@@ -80,6 +80,7 @@ Array [
                 },
               },
               "securityContext": Object {
+                "allowPrivilegeEscalation": false,
                 "privileged": false,
                 "readOnlyRootFilesystem": true,
                 "runAsGroup": 26000,
diff --git a/test/container.test.ts b/test/container.test.ts
index db14b0e4..baef2169 100644
--- a/test/container.test.ts
+++ b/test/container.test.ts
@@ -652,6 +652,9 @@ test('default security context', () => {
   expect(container.securityContext.ensureNonRoot).toBeTruthy();
   expect(container.securityContext.privileged).toBeFalsy();
   expect(container.securityContext.readOnlyRootFilesystem).toBeTruthy();
+  expect(container.securityContext.user).toEqual(25000);
+  expect(container.securityContext.group).toEqual(26000);
+  expect(container.securityContext.allowPrivilegeEscalation).toBeFalsy();
 
   expect(container._toKube().securityContext).toEqual(container.securityContext._toKube());
   expect(container.securityContext._toKube()).toStrictEqual({
@@ -660,6 +663,7 @@ test('default security context', () => {
     runAsGroup: container.securityContext.group,
     runAsNonRoot: container.securityContext.ensureNonRoot,
     runAsUser: container.securityContext.user,
+    allowPrivilegeEscalation: container.securityContext.allowPrivilegeEscalation,
   });
 
 });