SAST Scan Status

Report from the scan performed on   2023-08-28 at 05:56:18 for  

Repository Details
Branch master
Commit
Invocation Details
Security Audit for Infrastructure
Run Id 518b5465-3c50-45a1-bef9-cbca03e2d705
Directory file:///home/oran/Documents/ric-app-hw-python

Executive Summary

This report was generated by ShiftLeft from the SAST Scan invocation on 2023-08-28 at 05:56:18. The scan used the tool Security Audit for Infrastructure to scan the source code repository .

Below is a summary of the issues identified:

Severity Count
CRITICAL 2
HIGH 13
MEDIUM 0
LOW 4
TOTAL 19

 

  ShiftLeft recommends immediate remediation of the key issues identified before using this application in a live environment.

Key Issues 4 / 2

CKV_K8S_29

pod.yaml

Apply security context to your pods and containers.

 19: 19 apiVersion: v1
kind: Pod
metadata:

CKV_K8S_22

pod.yaml

Use read-only filesystem for containers where possible.

 19: 19 apiVersion: v1
kind: Pod
metadata:

CKV_K8S_40

pod.yaml

Containers should run as a high UID to avoid host conflict.

 19: 19 apiVersion: v1
kind: Pod
metadata:

CKV_K8S_28

pod.yaml

Minimize the admission of containers with the NET_RAW capability.

 19: 19 apiVersion: v1
kind: Pod
metadata:

All Issues (19)

Rule
Severity
Source location
Message
CRITICAL
The default namespace should not be used.
19 apiVersion: v1
kind: Pod
metadata:
CRITICAL
Containers should not run with allowPrivilegeEscalation.
19 apiVersion: v1
kind: Pod
metadata:
HIGH
Apply security context to your pods and containers.
19 apiVersion: v1
kind: Pod
metadata:
HIGH
Use read-only filesystem for containers where possible.
19 apiVersion: v1
kind: Pod
metadata:
HIGH
Containers should run as a high UID to avoid host conflict.
19 apiVersion: v1
kind: Pod
metadata:
HIGH
Minimize the admission of containers with the NET_RAW capability.
19 apiVersion: v1
kind: Pod
metadata:
HIGH
Image Pull Policy should be Always.
19 apiVersion: v1
kind: Pod
metadata:
HIGH
Readiness Probe Should be Configured.
19 apiVersion: v1
kind: Pod
metadata:
HIGH
Image should use digest.
19 apiVersion: v1
kind: Pod
metadata:
HIGH
Liveness Probe Should be Configured.
19 apiVersion: v1
kind: Pod
metadata:
HIGH
Minimize the admission of containers with capabilities assigned.
19 apiVersion: v1
kind: Pod
metadata:
HIGH
Ensure that the seccomp profile is set to docker/default or runtime/default.
19 apiVersion: v1
kind: Pod
metadata:
HIGH
Ensure that Service Account Tokens are only mounted where necessary.
19 apiVersion: v1
kind: Pod
metadata:
HIGH
Minimize the admission of root containers.
19 apiVersion: v1
kind: Pod
metadata:
HIGH
Apply security context to your pods and containers.
19 apiVersion: v1
kind: Pod
metadata:
LOW
CPU requests should be set.
19 apiVersion: v1
kind: Pod
metadata:
LOW
CPU limits should be set.
19 apiVersion: v1
kind: Pod
metadata:
LOW
Memory requests should be set.
19 apiVersion: v1
kind: Pod
metadata:
LOW
Memory limits should be set.
19 apiVersion: v1
kind: Pod
metadata:

Thank you for using ShiftLeft. Looking for a more detailed analysis? Check out ShiftLeft CORE or login to your dashboard.