What would you like to be added:
As of now terminal pods do not set much of the Pod Security Standards controls. It would be beneficial if these pods adhere to the PSS as much as possible, i.e. allow only required capabilities. Such configuration would include (non-exhaustive list of settings(Pod Security Context reference)):
- dropping container capabilities and only allowing required capabilities
- running as non root when possible (
runAsNonRoot )
- setting the SeccompProfile to
RuntimeDefault
- forbid
allowPrivilegeEscalation
- set
readOnlyRootFilesystem if possible
- consider mounting volumes as readonly if possible
What would you like to be added:
As of now terminal pods do not set much of the Pod Security Standards controls. It would be beneficial if these pods adhere to the PSS as much as possible, i.e. allow only required capabilities. Such configuration would include (non-exhaustive list of settings(Pod Security Context reference)):
runAsNonRoot)RuntimeDefaultallowPrivilegeEscalationreadOnlyRootFilesystemif possible