NET_RAW Capabilities Not Being Dropped @ /deploy/k8s/base/workshop/deployment.yaml

[AaronZhouYu]

Checkmarx (IaC-Security): NET_RAW Capabilities Not Being Dropped
Checkmarx Project: AaronZhouYu/TotallySecureApp
Repository URL: https://github.com/AaronZhouYu/TotallySecureApp
Branch: main
Scan ID: d9fa6dd5-d23b-4436-b75a-41a016305f39

---

Containers should drop 'ALL' or at least 'NET_RAW' capabilities

Locations:

Result #1:
Severity: MEDIUM
State: TO_VERIFY
Status: RECURRENT
    File: /deploy/k8s/base/workshop/deployment.yaml[16,0]
    Expected value: metadata.name={{crapi-workshop}}.spec.template.spec.initContainers.name={{wait-for-crapi-identity}}.securityContext.capabilities.drop should be defined
    Actual value: metadata.name={{crapi-workshop}}.spec.template.spec.initContainers.name={{wait-for-crapi-identity}}.securityContext.capabilities.drop is undefined
    Review result in Checkmarx One: NET_RAW Capabilities Not Being Dropped

Result #2:
Severity: MEDIUM
State: TO_VERIFY
Status: RECURRENT
    File: /deploy/k8s/base/workshop/deployment.yaml[22,0]
    Expected value: metadata.name={{crapi-workshop}}.spec.template.spec.initContainers.name={{wait-for-crapi-community}}.securityContext.capabilities.drop should be defined
    Actual value: metadata.name={{crapi-workshop}}.spec.template.spec.initContainers.name={{wait-for-crapi-community}}.securityContext.capabilities.drop is undefined
    Review result in Checkmarx One: NET_RAW Capabilities Not Being Dropped

Result #3:
Severity: MEDIUM
State: TO_VERIFY
Status: RECURRENT
    File: /deploy/k8s/base/workshop/deployment.yaml[29,0]
    Expected value: metadata.name={{crapi-workshop}}.spec.template.spec.containers.name={{crapi-workshop}}.securityContext.capabilities.drop should be defined
    Actual value: metadata.name={{crapi-workshop}}.spec.template.spec.containers.name={{crapi-workshop}}.securityContext.capabilities.drop is undefined
    Review result in Checkmarx One: NET_RAW Capabilities Not Being Dropped