Description
The operator manager deployment (config/manager/manager.yaml) has two security gaps:
1. Missing readOnlyRootFilesystem: true
The pod-level SecurityContext sets runAsNonRoot and seccompProfile: RuntimeDefault, and the container-level sets allowPrivilegeEscalation: false with all capabilities dropped. But readOnlyRootFilesystem is not set.
A writable rootfs also means a compromised process (RCE via a dependency vulnerability) could write to the container filesystem, drop a binary, modify /etc/resolv.conf, or plant a reverse shell.
The injected validation containers already set readOnlyRootFilesystem: true via restrictedSecurityContext() in #178. The operator's own container should match.
2. No resource limits
resources: {} - no default CPU or memory requests or limits. The manager runs a webhook in the pod admission path. Under load (node drain, HPA storm), unbounded memory usage can trigger node-level eviction pressure affecting other workloads.
Description
The operator manager deployment (
config/manager/manager.yaml) has two security gaps:1. Missing
readOnlyRootFilesystem: trueThe pod-level SecurityContext sets
runAsNonRootandseccompProfile: RuntimeDefault, and the container-level setsallowPrivilegeEscalation: falsewith all capabilities dropped. ButreadOnlyRootFilesystemis not set.A writable rootfs also means a compromised process (RCE via a dependency vulnerability) could write to the container filesystem, drop a binary, modify
/etc/resolv.conf, or plant a reverse shell.The injected validation containers already set
readOnlyRootFilesystem: trueviarestrictedSecurityContext()in #178. The operator's own container should match.2. No resource limits
resources: {}- no default CPU or memory requests or limits. The manager runs a webhook in the pod admission path. Under load (node drain, HPA storm), unbounded memory usage can trigger node-level eviction pressure affecting other workloads.