Privileged Kubernetes container (ARCH10021)

Key config.k8s.privileged-container · Severity error · Category security · CWE CWE-250

A privileged container reaches every device and kernel capability of the node; a container that allows privilege escalation lets a process inside gain more rights than it started with. Pods, Deployments, StatefulSets, DaemonSets, ReplicaSets, Jobs and CronJobs are read.

Incorrect

apiVersion: apps/v1
kind: Deployment
metadata:
  name: agent
spec:
  selector:
    matchLabels:
      app: agent
  template:
    metadata:
      labels:
        app: agent
    spec:
      containers:
        - name: agent
          image: example/agent:2.4.1
          securityContext:
            privileged: true

Correct

apiVersion: apps/v1
kind: Deployment
metadata:
  name: agent
spec:
  selector:
    matchLabels:
      app: agent
  template:
    metadata:
      labels:
        app: agent
    spec:
      containers:
        - name: agent
          image: example/agent:2.4.1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add: ["NET_ADMIN"]

Fix

Remove privileged, set allowPrivilegeEscalation: false, and grant only the capability the container needs (securityContext.capabilities.add).

Not flagged

• Helm templates ({{ ... }}): they are not valid YAML until rendered and are not read.