Ensure The Seccomp Profile Is Set To RuntimeDefault In Pod Definitions

# 1. List all pods and show their seccomp profile status (cluster-wide)
# Run on: any machine with kubectl access
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | {
        namespace: .metadata.namespace,
        name: .metadata.name,
        podAnnotation: .metadata.annotations["seccomp.security.alpha.kubernetes.io/pod"],
        podProfile: .spec.securityContext.seccompProfile.type,
        containerProfiles: (
          .spec.containers[]
          | {name: .name, profile: .securityContext.seccompProfile.type}
        )
      }'

# Interpretation:
# - Good:
#   - podProfile is "RuntimeDefault", OR
#   - podAnnotation is "runtime/default", OR
#   - every containerProfiles[].profile is "RuntimeDefault"
# - Needs attention:
#   - podProfile is null/empty AND podAnnotation is null/empty AND
#     one or more containers have profile null/empty
#   - Any profile set to "Unconfined"

# 2. Quickly list only pods with missing or unconfined seccomp profiles
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | select(
        (
          (.spec.securityContext.seccompProfile.type // "") == ""
          and (.metadata.annotations["seccomp.security.alpha.kubernetes.io/pod"] // "") == ""
          and ([.spec.containers[]
                | .securityContext.seccompProfile.type // ""
               ] | any(. == ""))
        )
        or
        (
          (
            .spec.securityContext.seccompProfile.type == "Unconfined"
            or .metadata.annotations["seccomp.security.alpha.kubernetes.io/pod"] == "unconfined"
            or ([.spec.containers[]
                  | .securityContext.seccompProfile.type // ""
                 ] | any(. == "Unconfined"))
          )
        )
      )
    | "\(.metadata.namespace) \t \(.metadata.name)"'

# Interpretation:
# - Every line in the output is a pod that should be manually reviewed.
# - If nothing is printed, all pods have some seccomp configuration and none
#   are explicitly Unconfined (you may still choose to tighten policies).

# 3. Inspect a specific pod in detail (replace values as needed)
NAMESPACE=kube-system
POD_NAME=metrics-server-v0.7.0-dbcc8ddf6-gz7d4

kubectl get pod "$POD_NAME" -n "$NAMESPACE" -o yaml \
  | yq '.metadata.annotations, .spec.securityContext.seccompProfile, .spec.containers[].securityContext.seccompProfile'

# Interpretation:
# - Confirm whether:
#   - metadata.annotations["seccomp.security.alpha.kubernetes.io/pod"] == "runtime/default"
#     OR
#   - spec.securityContext.seccompProfile.type == "RuntimeDefault"
#     OR
#   - each container has securityContext.seccompProfile.type == "RuntimeDefault".
# - If none of these are true, this pod is not using RuntimeDefault and
#   should be evaluated for updating its pod or container securityContext.
</Accordion>

<Accordion title='Automation'>
```bash
#!/usr/bin/env bash
# Report pods that do NOT use seccomp RuntimeDefault at pod or container level

set -euo pipefail

# REQUIREMENT: run on any machine with kubectl access and jq installed

echo "Scanning pods for non-RuntimeDefault seccomp usage..."

kubectl get pods --all-namespaces -o json | jq -r '
  .items[]
  | {
      ns: .metadata.namespace,
      name: .metadata.name,
      pod_anno: .metadata.annotations["seccomp.security.alpha.kubernetes.io/pod"],
      pod_type: .spec.securityContext.seccompProfile.type,
      containers: (
        (.spec.containers // []) as $cs
        | [ $cs[]
            | {
                name: .name,
                anno: .securityContext?.seccompProfile?.type,
                old_anno: .annotations["seccomp.security.alpha.kubernetes.io/container"]
              }
          ]
      )
    }
  # Keep only pods where *any* level is NOT RuntimeDefault (or is unset)
  | select(
      # pod-level modern type not RuntimeDefault or missing
      ((.pod_type // "") != "RuntimeDefault")
      or
      # legacy pod annotation not runtime/default or missing
      ((.pod_anno // "") != "runtime/default")
      or
      # any container without RuntimeDefault (modern) AND without legacy annotation
      ([
        .containers[]
        | (
            ((.anno // "") != "RuntimeDefault")
            and
            ((.old_anno // "") != "runtime/default")
          )
      ] | any)
    )
  | "NAMESPACE=\(.ns)\tPOD=\(.name)\tPOD_SEC_PROFILE=\(.pod_type // "NONE")\tPOD_OLD_ANNOT=\(.pod_anno // "NONE")"
'

echo
echo "Explanation:"
echo "- Any line in the output represents a POD that is NOT fully configured with seccomp RuntimeDefault."
echo "- POD_SEC_PROFILE=RuntimeDefault or POD_OLD_ANNOT=runtime/default at the pod level is the modern/legacy compliant setting."
echo "- If the script prints no pods, then every pod has RuntimeDefault at pod level or all containers do (via modern or legacy settings)."