Run shell untrusted
Event Information
Meaning
- The “Run shell untrusted” event in a Kubernetes cluster indicates that a shell command was executed within a container running in the cluster, and it was flagged as untrusted.
- This event typically occurs when a user or process attempts to run a shell command that is not allowed or violates the security policies defined for the cluster.
- It is important to investigate this event further to determine the source of the command and assess whether it poses a security risk or violates any compliance standards.
To investigate further, you can:
- Use the
kubectl get pods
command to identify the pod in which the event occurred. - Use the
kubectl logs <pod-name>
command to view the logs of the container and look for any suspicious or unauthorized shell commands. - Review the security policies and access controls in place to ensure that only trusted and authorized commands are allowed to be executed within the cluster.
Remediation
- Create a Kubernetes Deployment manifest file with the necessary specifications for running a Python script:
apiVersion: apps/v1
kind: Deployment
metadata:
name: remediation-script
spec:
replicas: 1
selector:
matchLabels:
app: remediation-script
template:
metadata:
labels:
app: remediation-script
spec:
containers:
- name: remediation-script
image: python:3.9
command: ["python", "-c"]
args: ["print('Remediation script executed successfully!')"]
- Apply the Deployment manifest using the
kubectl apply
command:
kubectl apply -f deployment.yaml
- Verify that the Deployment is running and the remediation script has executed successfully:
kubectl get pods
kubectl logs <pod-name>
Note: Replace <pod-name>
with the actual name of the pod created by the Deployment.