Privilege Escalation Allowed @ /deploy/k8s/base/identity/deployment.yaml

[AaronZhouYu]

Checkmarx (IaC-Security): Privilege Escalation Allowed
Checkmarx Project: AaronZhouYu/TotallySecureApp
Repository URL: https://github.com/AaronZhouYu/TotallySecureApp
Branch: main
Scan ID: d9fa6dd5-d23b-4436-b75a-41a016305f39

---

Containers should not run with allowPrivilegeEscalation in order to prevent them from gaining more privileges than their parent process

Locations:

Result #1:
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
    File: /deploy/k8s/base/identity/deployment.yaml[23,0]
    Expected value: metadata.name={{crapi-identity}}.spec.template.spec.containers.name={{crapi-identity}}.securityContext.allowPrivilegeEscalation should be set and should be set to false
    Actual value: metadata.name={{crapi-identity}}.spec.template.spec.containers.name={{crapi-identity}}.securityContext.allowPrivilegeEscalation is undefined
    Review result in Checkmarx One: Privilege Escalation Allowed

Result #2:
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
    File: /deploy/k8s/base/identity/deployment.yaml[16,0]
    Expected value: metadata.name={{crapi-identity}}.spec.template.spec.initContainers.name={{wait-for-postgres}}.securityContext.allowPrivilegeEscalation should be set and should be set to false
    Actual value: metadata.name={{crapi-identity}}.spec.template.spec.initContainers.name={{wait-for-postgres}}.securityContext.allowPrivilegeEscalation is undefined
    Review result in Checkmarx One: Privilege Escalation Allowed