Repository: aquasecurity/starboard
Pull request #360 (2021-01-23 23:15:48)

Set security context for polaris
This PR adds SecurityContexts to the `polaris` Job in order to run the job with the least amount of privilege possible, in partial fulfillment of #163.

I ran the job with and without the changes in a local kind cluster and I did not see a difference in the output.

To obtain the output, I ran:
```
kubectl create deployment nginx --image nginx:1.16
kubectl wait --for=condition=available deploy/nginx --timeout=60s
./bin/starboard scan configauditreports deployment/nginx
./bin/starboard get configaudit deployment/nginx -o yaml >cars.yaml
```

codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/360?src=pr&el=h1) Report
> Merging [#360](https://codecov.io/gh/aquasecurity/starboard/pull/360?src=pr&el=desc) (69fa837) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/ab281e4060f0f84a2bb0b36c243c283d26f93c02?el=desc) (ab281e4) will **decrease** coverage by `16.13%`.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/aquasecurity/starboard/pull/360/graphs/tree.svg?width=650&height=150&src=pr&token=qqTGKAJ0Wb)](https://codecov.io/gh/aquasecurity/starboard/pull/360?src=pr&el=tree)

```diff
@@             Coverage Diff             @@
##             main     #360       +/-   ##
===========================================
- Coverage   66.35%   50.22%   -16.14%     
===========================================
  Files          58       11       -47     
  Lines        3026     1099     -1927     
===========================================
- Hits         2008      552     -1456     
+ Misses        769      471      -298     
+ Partials      249       76      -173     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/360?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pkg/vulnerabilityreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/360/diff?src=pr&el=tree#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-75.54%)` | :arrow_down: |
| [pkg/vulnerabilityreport/io.go](https://codecov.io/gh/aquasecurity/starboard/pull/360/diff?src=pr&el=tree#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvaW8uZ28=) | `30.00% <0.00%> (-53.34%)` | :arrow_down: |
| [pkg/trivy/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/360/diff?src=pr&el=tree#diff-cGtnL3RyaXZ5L3BsdWdpbi5nbw==) | `45.01% <0.00%> (-28.05%)` | :arrow_down: |
| [pkg/operator/predicate/predicate.go](https://codecov.io/gh/aquasecurity/starboard/pull/360/diff?src=pr&el=tree#diff-cGtnL29wZXJhdG9yL3ByZWRpY2F0ZS9wcmVkaWNhdGUuZ28=) | `85.71% <0.00%> (-9.53%)` | :arrow_down: |
| [pkg/trivy/converter.go](https://codecov.io/gh/aquasecurity/starboard/pull/360/diff?src=pr&el=tree#diff-cGtnL3RyaXZ5L2NvbnZlcnRlci5nbw==) | `81.25% <0.00%> (-9.38%)` | :arrow_down: |
| [pkg/cmd/commands.go](https://codecov.io/gh/aquasecurity/starboard/pull/360/diff?src=pr&el=tree#diff-cGtnL2NtZC9jb21tYW5kcy5nbw==) | | |
| [pkg/cmd/get\_report.go](https://codecov.io/gh/aquasecurity/starboard/pull/360/diff?src=pr&el=tree#diff-cGtnL2NtZC9nZXRfcmVwb3J0Lmdv) | | |
| [pkg/resources/resources.go](https://codecov.io/gh/aquasecurity/starboard/pull/360/diff?src=pr&el=tree#diff-cGtnL3Jlc291cmNlcy9yZXNvdXJjZXMuZ28=) | | |
| [pkg/config/config.go](https://codecov.io/gh/aquasecurity/starboard/pull/360/diff?src=pr&el=tree#diff-cGtnL2NvbmZpZy9jb25maWcuZ28=) | | |
| [pkg/cmd/kube\_hunter.go](https://codecov.io/gh/aquasecurity/starboard/pull/360/diff?src=pr&el=tree#diff-cGtnL2NtZC9rdWJlX2h1bnRlci5nbw==) | | |
| ... and [41 more](https://codecov.io/gh/aquasecurity/starboard/pull/360/diff?src=pr&el=tree-more) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/360?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/360?src=pr&el=footer). Last update [ab281e4...69fa837](https://codecov.io/gh/aquasecurity/starboard/pull/360?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/pkg/polaris/plugin.go b/pkg/polaris/plugin.go
index 308eed8..e754445 100644
--- a/pkg/polaris/plugin.go
+++ b/pkg/polaris/plugin.go
@@ -93,6 +93,21 @@ func (p *plugin) GetScanJobSpec(workload kube.Object, gvk schema.GroupVersionKin
 					"--config", "/etc/starboard/polaris.config.yaml",
 					"--resource", sourceName,
 				},
+				SecurityContext: &corev1.SecurityContext{
+					Privileged:               pointer.BoolPtr(false),
+					AllowPrivilegeEscalation: pointer.BoolPtr(false),
+					Capabilities: &corev1.Capabilities{
+						Drop: []corev1.Capability{"all"},
+					},
+					ReadOnlyRootFilesystem: pointer.BoolPtr(true),
+				},
+			},
+		},
+		SecurityContext: &corev1.PodSecurityContext{
+			RunAsUser:  pointer.Int64Ptr(1000),
+			RunAsGroup: pointer.Int64Ptr(1000),
+			SeccompProfile: &corev1.SeccompProfile{
+				Type: corev1.SeccompProfileTypeRuntimeDefault,
 			},
 		},
 	}, nil


Test patch:
diff --git a/pkg/polaris/plugin_test.go b/pkg/polaris/plugin_test.go
index c21cc5c..e032733 100644
--- a/pkg/polaris/plugin_test.go
+++ b/pkg/polaris/plugin_test.go
@@ -95,6 +95,21 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							"--config", "/etc/starboard/polaris.config.yaml",
 							"--resource", "default/Deployment.apps/v1/nginx",
 						},
+						SecurityContext: &corev1.SecurityContext{
+							Privileged:               pointer.BoolPtr(false),
+							AllowPrivilegeEscalation: pointer.BoolPtr(false),
+							Capabilities: &corev1.Capabilities{
+								Drop: []corev1.Capability{"all"},
+							},
+							ReadOnlyRootFilesystem: pointer.BoolPtr(true),
+						},
+					},
+				},
+				SecurityContext: &corev1.PodSecurityContext{
+					RunAsUser:  pointer.Int64Ptr(1000),
+					RunAsGroup: pointer.Int64Ptr(1000),
+					SeccompProfile: &corev1.SeccompProfile{
+						Type: corev1.SeccompProfileTypeRuntimeDefault,
 					},
 				},
 			},