Skip to content

Remove would violate PodSecurity "restricted:latest" warnings #1

Closed as not planned
Task
Closed as not planned
Remove would violate PodSecurity "restricted:latest" warnings#1
Task
Labels
quality-of-lifeQoL improvements

Description

@kvaps
Andrei Kvapil (kvaps)
opened on Jan 26, 2024

We have to refactor all our apps to avoid such warnings:

Warning: would violate PodSecurity "restricted:latest": host namespaces (hostNetwork=true), allowPrivilegeEscalation != false (containers "cozystack", "darkhttpd" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "cozystack", "darkhttpd" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "cozystack", "darkhttpd" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "cozystack", "darkhttpd" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

Activity

  1. Marian Koreniuk (themoriarti)
    added a commit that references this issue on Apr 18, 2024

    Merge pull request #1 from artarik/artarik-patch-1

    aef38b6

  2. themoriarti commented on Jul 3, 2024

    @themoriarti
    Marian Koreniuk (themoriarti)
    on Jul 3, 2024
    Collaborator

    Andrei Kvapil (@kvaps) How to reproduce this problem or how it occurs, where to look? If there is any evidence, it will be possible to investigate.

  3. Nick Volynkin (NickVolynkin)
    added the
    Bug
    issue type on Mar 25, 2025
  4. Nick Volynkin (NickVolynkin)
    removed the
    Bug
    issue type on Mar 25, 2025
  5. Nick Volynkin (NickVolynkin)
    added the
    Task
    issue type on Mar 25, 2025
  6. Nick Volynkin (NickVolynkin)
    added
    quality-of-lifeQoL improvements
    on Mar 25, 2025

  7. dosubot commented on Oct 18, 2025

    @dosubot
    dosubotbot
    on Oct 18, 2025 – with DosuBot

    Hi, Andrei Kvapil (@kvaps). I'm Dosu, and I'm helping the cozystack team manage their backlog and am marking this issue as stale.

    Issue Summary:

    • You requested a refactor of all applications to remove PodSecurity "restricted:latest" warnings.
    • The focus is on addressing host namespaces, privilege escalation, capabilities, runAsNonRoot, and seccompProfile settings.
    • The goal is to ensure compliance with PodSecurity standards.
    • The maintainer asked for reproduction steps or evidence to investigate further.
    • No additional updates or solutions have been provided since then.

    Next Steps:

    • Please let me know if this issue is still relevant with the latest version of cozystack by commenting here.
    • If I don’t hear back within 7 days, I will automatically close this issue.

    Thank you for your understanding and contribution!

  8. dosubot
    added
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale
    on Oct 18, 2025
  9. dosubot
    closed this as not plannedon Oct 25, 2025
  10. dosubot
    removed
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale
    on Oct 25, 2025
  11. Timofei Larkin (lllamnyp)
    added a commit that references this issue on Nov 4, 2025

    [nats] Fixes for NATS App Helm chart, fix template issues with config…

    634649f
  12. myasnikovdaniil
    added a commit that references this issue on Apr 29, 2026

    fix(harbor): drive bucket-secret.yaml from values, gate HR on BucketInfo

    a21c18f
  13. Aleksei Sviridkin (lexfrei)
    added a commit that references this issue on May 2, 2026

    fix(ouroboros): address review pass 3

    2487afa
  14. Sergei Makarov (SerjioTT)
    added a commit that references this issue on May 5, 2026

    fix(harbor): drive bucket-secret.yaml from values, gate HR on BucketInfo

    8daf495
  15. myasnikovdaniil
    added a commit that references this issue on May 5, 2026

    test(e2e): add --ignore-not-found to vminstance.bats end-of-test deletes

    fe138af
  16. IvanHunters
    added 3 commits that reference this issue on Jul 4, 2026

    fix(operator): hold final backoff window before give-up, note upstrea…

    578b9aa

    fix(operator): hold final backoff window before give-up, note upstrea…

    66d39cf

    fix(operator): hold final backoff window before give-up, note upstrea…

    0d98e27
  17. Andrei Kvapil (kvaps)
    added 3 commits that reference this issue on Aug 25, 2026

    docs(roadmap): align near-term plan with committed capacity

    a18d228

    docs(roadmap): move the IDP bundle to 2027 Q1

    10fa8d9

    docs: add public ROADMAP.md (2026-2028) (#2666)

    652231e
  18. Andrei Kvapil (kvaps)
    added a commit that references this issue on Sep 7, 2026

    docs: add public ROADMAP.md (2026-2028) (#2666)

    2f22670
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    quality-of-lifeQoL improvements

    Type

    Task

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions