Skip to content

[Security] Harden IaC based on Sysdig CLI Scanner results #409

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 47 commits into
base: main
Choose a base branch
from

Conversation

higakikeita
Copy link

This PR applies security best practices to Kubernetes manifests based on IaC scan results using Sysdig CLI Scanner.

✅ Improvements:

  • Set serviceAccountName on all workloads
  • Dropped all Linux capabilities
  • Enabled readOnlyRootFilesystem
  • Added runAsUser: 1000 and runAsNonRoot: true
  • Defined CPU and memory requests and limits
  • Added basic livenessProbe and readinessProbe

Scan date: 2025-07-16
Tool: Sysdig CLI Scanner 1.22.4
sysdig-iac-fix-report.md

Sysdig IaC Scan 修正提案レポート

  • 対象リポジトリ: example-voting-app
  • スキャン実行日: 2025年07月16日
  • 使用ツール: Sysdig CLI Scanner v1.22.4

🔴 High Severity Issues & 修正案

1. serviceAccountName が未設定

対象: db, redis, vote, result, worker

spec:
  serviceAccountName: default

2. rootユーザーでの実行 (runAsUser 未定義)

securityContext:
  runAsUser: 1000
  runAsNonRoot: true

3. ルートファイルシステムが書き込み可能

securityContext:
  readOnlyRootFilesystem: true

4. capabilitiesNET_RAW などが含まれている

securityContext:
  capabilities:
    drop:
      - ALL

🟠 Medium Severity Issues & 修正案

5. リソース制限とリクエストが未設定

resources:
  requests:
    cpu: "100m"
    memory: "128Mi"
  limits:
    cpu: "500m"
    memory: "256Mi"

6. livenessProbe / readinessProbe が未設定

livenessProbe:
  httpGet:
    path: /
    port: 80
  initialDelaySeconds: 5
  periodSeconds: 10

readinessProbe:
  httpGet:
    path: /
    port: 80
  initialDelaySeconds: 5
  periodSeconds: 5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant