Missing Kubernetes security controls risk container escape
Kubernetes manifests did not set the standard `securityContext` controls (runAsNonRoot, readOnlyRootFilesystem, drop ALL capabilities), increasing the blast radius of any container compromise.
Description
The Kubernetes manifests did not include hardened securityContext settings: runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation: false, capability drops, and seccomp profiles were not configured. A compromised container would have more permissions than necessary.
Recommendation
Add securityContext to all pods and containers: runAsNonRoot: true, readOnlyRootFilesystem: true, allowPrivilegeEscalation: false, drop ALL capabilities and re-add only the ones required, and apply a RuntimeDefault seccomp profile.
Initia: Acknowledged. Pashov Audit Group: Acknowledged.