security(kubescape): three Deployments genuinely fail C-0055 behind the blanket pod-security exception

🤖 Generated by the Agentic Engineer

Evidence

pod-security-mutations suppresses C-0013/C-0016/C-0055/C-0211 cluster-wide, and the compensating
Kyverno mutation does not run in the namespaces it excludes (#2824). Measuring what that actually
hides, against prod on 2026-08-10:

Four excluded namespaces — kube-public, kube-node-lease, local-path-storage, chaos-mesh —
run no workloads, so nothing is suppressed there.
Of the 24 workloads in the remaining namespaces, 21 already satisfy these controls in their own
specs (flux-system, cert-manager, keda, opencost and kubescape/alertmanager are fully
hardened container-side).
Three do not: the kubescape, kubevuln and operator Deployments in the kubescape
namespace each set runAsNonRoot and allowPrivilegeEscalation: false, but carry no
capabilities.drop and no container-level seccompProfile — so C-0055 is genuinely unmet, not
merely unscanned.
kubescape/node-agent is legitimately privileged (eBPF) and already covered by name in
kubescape-privileged.yaml for C-0013/C-0016/C-0055.

Problem

The blanket exception was declared rather than narrowed because the remediation was unsized. It is
now sized, and it is small: three workloads need a genuine in-spec fix, and the rest would pass on
their own. Until they are hardened, the suppression is doing real work for those three — which is
the case #2824 exists to remove.

Expected

The three Deployments drop all capabilities and set a container-level seccompProfile, so the
controls pass genuinely rather than being suppressed. These are upstream chart defaults, so the fix
belongs in the HelmRelease values (or a scoped exception if a component turns out to need a
capability).

Acceptance criteria

kubescape, kubevuln and operator set capabilities.drop: [ALL] and a container-level
seccompProfile in their own specs, or carry a workload-scoped exception whose reason is true.
Verified against the running workloads, not only the rendered manifests.
C-0211 coverage for node-agent is decided explicitly (it is exempted in no CR today).
The compliance floor is re-baselined upward if the score moves; never lowered.

Size

Small. This is the remediation half of the measurement #2824 asked for; narrowing the blanket
exception itself remains blocked on a scope the CSE designators cannot express.

Part of #2824

🔗 Related PRs

#2316 - fix(kubescape): make ClusterSecurityException posture exceptions take effect [merged]
#2434 - fix(kubescape): except GitOps-managed CronJobs from C-0026 posture control [merged]
#2440 - fix(security): make C-0002 exec-into-container exception effective for infra controllers [merged]
#2442 - fix(kubescape): make C-0015 secret-list exceptions take effect [merged]
#2446 - fix(kubescape): except C-0007 delete-capable RBAC by object, not namespace [merged]
#2455 - fix(security): harden containers with read-only root filesystems (Kubescape C-0017) [merged]

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

Create Plan

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

🤖 Generated by the Agentic Engineer

Scope addition: C-0211 needs its own per-workload pass

Review on #3063 established that the measurement behind this issue is sound only for
C-0013/C-0016/C-0055, and does not carry over to C-0211. Adding that to this issue's scope, because
the exception's annotation now points here for it.

Why C-0211 is different:

It is exempted in no CR other than pod-security-mutations, so nothing compensates it anywhere
the mutation is absent.
Its field set differs — add-pod-security-context supplies fsGroupChangePolicy, runAsUser and
runAsGroup alongside the fields the other three controls check.
kubescape-privileged.yaml covers node-agent and storage for C-0013/C-0016/C-0055 only, so
both remain inside C-0211's residual population rather than excepted out of it.
alertmanager is a concrete instance: its live pod context is
{fsGroup: 65534, runAsNonRoot: true, seccompProfile: RuntimeDefault} — no fsGroupChangePolicy,
which the mutation would supply in a mutated namespace. It is hardened for the container-level
controls and still not clean for C-0211.

Added acceptance criteria

Enumerate the C-0211 residual population across the twelve unmutated namespaces per workload,
including node-agent, storage and alertmanager.
Each either satisfies C-0211 in its own spec, or carries a scoped exception whose reason is
true of it — the control is currently suppressed with nothing compensating it.

A useful trap to record for whoever picks this up: read the mutation policy's match blocks, not
only its exclude blocks. add-imageuid-pod-security-context carries no exclusions and matches
cert-manager, keda and opencost by name, so those namespaces are mutated despite being excluded
from add-pod-security-context.

chore: agent-claim #3064 nonce=162cb20cbfd9470ae50e739c8083c7a3

security(eks): re-approve the rendered authorization surface fingerprint

chore(security): re-approve the authorization-surface fingerprint for #…

Navigation Menu

Repository navigation

security(kubescape): three Deployments genuinely fail C-0055 behind the blanket pod-security exception #3064

Evidence

Problem

Expected

Acceptance criteria

Size

Scope addition: C-0211 needs its own per-workload pass

Added acceptance criteria

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

security(kubescape): three Deployments genuinely fail C-0055 behind the blanket pod-security exception #3064

Description

Evidence

Problem

Expected

Acceptance criteria

Size

Activity

coderabbitai commented on Aug 10, 2026

devantler commented on Aug 10, 2026

Scope addition: C-0211 needs its own per-workload pass

Added acceptance criteria

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions