Apply Security Context To Your Pods And Containers

# 1) List all pods and their security context usage (namespaces, pod & container level)
# Run on: any machine with kubectl access
kubectl get pods --all-namespaces -o custom-columns=\
NAMESPACE:.metadata.namespace,\
POD:.metadata.name,\
POD_SC:.spec.securityContext,\
CONTAINERS_SC:.spec.containers[*].securityContext

# 2) Inspect full spec for specific pods (e.g., application namespaces)
# Replace <namespace> and <pod-name> with actual values from your cluster
kubectl -n <namespace> get pod <pod-name> -o yaml

# 3) Identify containers running as root or lacking non-root guarantees
kubectl get pods --all-namespaces -o jsonpath='
{range .items[*]}
{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}
{range .spec.containers[*]}
{"runAsUser="}{.securityContext.runAsUser}{" "}
{"runAsNonRoot="}{.securityContext.runAsNonRoot}{" "}
{"privileged="}{.securityContext.privileged}{" "}
{"allowPrivilegeEscalation="}{.securityContext.allowPrivilegeEscalation}{"; "}
{end}{"\n"}
{end}'

# 4) Show pods with any privileged container
kubectl get pods --all-namespaces -o json | \
jq -r '
  .items[]
  | {ns: .metadata.namespace, pod: .metadata.name, containers: .spec.containers}
  | select(.containers[]?.securityContext?.privileged == true)
  | "\(.ns)\t\(.pod)"
'

# 5) Show pods where allowPrivilegeEscalation is true or unset
kubectl get pods --all-namespaces -o json | \
jq -r '
  .items[]
  | {ns: .metadata.namespace, pod: .metadata.name, containers: .spec.containers}
  | select(
      [.containers[]? | .securityContext.allowPrivilegeEscalation] 
      | any(. == true or . == null)
    )
  | "\(.ns)\t\(.pod)"
'

#!/usr/bin/env bash
#
# Report pods and containers that lack recommended securityContext settings.
# Run on any machine with kubectl access and current context set.
#
# This is a read-only assessment. It does NOT change the cluster.

set -euo pipefail

# Fail fast if kubectl is not available or cannot reach the cluster
kubectl version --short >/dev/null 2>&1 || {
  echo "ERROR: kubectl not available or cannot reach the cluster" >&2
  exit 1
}

echo "Collecting pod securityContext information from all namespaces..."
echo

# Headers
printf "%-32s %-24s %-40s %-12s %-7s %-7s %-9s %-11s %-11s %-11s %-9s %-9s\n" \
  "NAMESPACE" "POD" "CONTAINER" "TYPE" "UID" "GID" "PRIVILEGED" "HOSTPID" "HOSTIPC" "HOSTNET" "ROFS" "DROPCAPS"

# Explanation of columns (for later review)
cat <<'EOF'

COLUMN MEANING (a blank/empty value is what you need to review):
  UID        : runAsUser (effective user ID)
  GID        : runAsGroup or fsGroup (effective group ID)
  PRIVILEGED : container.securityContext.privileged
  HOSTPID    : pod.spec.hostPID
  HOSTIPC    : pod.spec.hostIPC
  HOSTNET    : pod.spec.hostNetwork
  ROFS       : container.securityContext.readOnlyRootFilesystem
  DROPCAPS   : whether NET_RAW (and other caps) are dropped

Rows where UID/GID/ROFS/DROPCAPS are empty or PRIVILEGED/HOST* are "true"
indicate items to review against your security policy.

EOF

# Use a single JSON query and format in bash for readability at scale
kubectl get pods -A -o json \
| jq -r '
  .items[]
  | . as $pod
  | (
      # pod-level fields
      .metadata.namespace as $ns
      | .metadata.name as $podName
      | (.spec.securityContext // {}) as $psc
      | (.spec.hostPID // false) as $hostPID
      | (.spec.hostIPC // false) as $hostIPC
      | (.spec.hostNetwork // false) as $hostNet
      | ($psc.runAsUser // empty) as $podUid
      | ($psc.runAsGroup // empty) as $podGid
      | ($psc.fsGroup // empty) as $podFsGroup
      | .spec.containers[]
      | .name as $cname
      | (.securityContext // {}) as $csc
      | ($csc.runAsUser // $podUid // empty) as $uid
      | ($csc.runAsGroup // $podGid // empty) as $gid
      | ($psc.fsGroup // $podFsGroup // empty) as $fsgid
      | ($csc.privileged // false) as $priv
      | ($csc.readOnlyRootFilesystem // empty) as $rofs
      | (($csc.capabilities.drop // []) | map(select(. == "NET_RAW")) | length > 0) as $dropNetRaw
      | (($csc.capabilities.drop // []) | length > 0) as $dropAnyCap
      | [
          $ns,
          $podName,
          $cname,
          "main",
          (if $uid|tostring == "null" then "" else ($uid|tostring) end),
          (if $gid|tostring == "null" then "" else ($gid|tostring) end),
          (if $priv then "true" else "false" end),
          (if $hostPID then "true" else "false" end),
          (if $hostIPC then "true" else "false" end),
          (if $hostNet then "true" else "false" end),
          (if $rofs|tostring == "null" then "" else ($rofs|tostring) end),
          (if $dropAnyCap then (if $dropNetRaw then "yes+NET_RAW" else "yes" end) else "" end)
        ]
    )
  | @tsv
' \
| while IFS=$'\t' read -r ns pod cname type uid gid priv hostpid hostipc hostnet rofs dropcaps; do
    printf "%-32s %-24s %-40s %-12s %-7s %-7s %-9s %-11s %-11s %-11s %-9s %-9s\n" \
      "$ns" "$pod" "$cname" "$type" "$uid" "$gid" "$priv" "$hostpid" "$hostipc" "$hostnet" "$rofs" "$dropcaps"
  done

cat <<'EOF'

HOW TO INTERPRET POTENTIAL PROBLEMS:

Review rows where:
  - UID and/or GID are empty:
      No explicit runAsUser/runAsGroup configured at pod or container level.
  - ROFS is empty or "false":
      Root filesystem is writable for the container.
  - DROPCAPS is empty:
      No Linux capabilities explicitly dropped (e.g., NET_RAW).
  - PRIVILEGED is "true":
      Privileged container – only allow if strongly justified.
  - HOSTPID / HOSTIPC / HOSTNET are "true":
      Pod shares host namespaces – only allow if strongly justified.

Use this report to:
  1. Identify high‑risk pods/containers.
  2. Review their manifests/Helm charts against your security standards.
  3. Add or tighten securityContext where appropriate (pod and/or container level).

Note: This script only reports state; applying securityContext changes must be done
manually through your normal deployment workflow (manifests, Helm, GitOps, etc.).
EOF