security(kubescape): classify C-0211's privilege-adjacent residual so the unscoped exception can narrow #4210

🤖 Generated by the Agentic Engineer

Evidence

On 2026-09-26 I re-measured the C-0211 population against the live prod stored specs, which is the surface Kubescape scans. The population is the scanned workloads in the four namespaces that add-security-context excludes: 38 workloads (flux-system 5, longhorn-system 10, observability 21, velero 2).

• The two non-privilege gaps are closed on all 38. Every workload carries a pod-level fsGroupChangePolicy, and an effective seLinuxOptions object reaches every container. security(kubescape): patch the two non-privilege C-0211 fields into workload templates, so the exception can narrow #3522 delivered this.
• 19 of 38 still miss at least one privilege-adjacent field. Per namespace: flux-system 1, longhorn-system 10, observability 7, velero 1. By field: fsGroup is missing on 19, runAsGroup on 11, and runAsNonRoot on 11.

The per-workload table is kept in private operator notes.

Audience and problem

pod-security-mutations-unscoped suppresses C-0211 cluster-wide, so every workload reports passed w/exceptions whatever its real state. Narrowing the exception today would surface 19 findings with no fix behind them. So the exception cannot narrow until each of the 19 is either fixed or deliberately excepted.

These are the fields the namespace exclusions exist to protect. Many of these workloads, such as storage-plane DaemonSets and node agents, legitimately need to run as root.

Hypothesis

Sorting the 19 into two groups makes the exception narrowable. Some can take the fields at source without breaking, through chart values or kustomize patches. The rest genuinely need root; each of those gets a scoped, name-level exception with its reason. The cluster-wide pod-security-mutations-unscoped exception can then be replaced by exceptions that name what they cover.

Success signal

pod-security-mutations-unscoped no longer suppresses C-0211 cluster-wide. After narrowing, a re-measurement against the stored specs shows that every workload is either passing, or covered by a named exception whose reason is recorded.

Smallest useful change

Start with the cheapest group, the workloads that already run as non-root and lack only fsGroup, and set fsGroup at source for them.

Acceptance criteria

• Each of the 19 is classified: fix at source, or scoped exception with a recorded reason.
• The fixable ones carry the fields in their stored spec, verified read-only on prod.
• C-0211 is narrowed out of pod-security-mutations-unscoped once nothing unfixed would surface.