Apply Security Context For Pods And Containers

# 1) List all pods and their service accounts (for triage)
# Run on: any machine with kubectl access
kubectl get pods -A -o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,SA:.spec.serviceAccountName'

# 2) Show pods that define NO pod-level securityContext
# Run on: any machine with kubectl access
kubectl get pods -A -o json | \
  jq -r '
    .items[]
    | select(.spec.securityContext == null)
    | [.metadata.namespace, .metadata.name]
    | @tsv
  '

# 3) Show containers that define NO container-level securityContext
# Run on: any machine with kubectl access
kubectl get pods -A -o json | \
  jq -r '
    .items[]
    | . as $pod
    | ($pod.spec.containers // [])[]
    | select(.securityContext == null)
    | [$pod.metadata.namespace, $pod.metadata.name, .name]
    | @tsv
  '

# 4) Show privileged containers
# Run on: any machine with kubectl access
kubectl get pods -A -o json | \
  jq -r '
    .items[]
    | . as $pod
    | ($pod.spec.containers // [])[]
    | select(.securityContext.privileged == true)
    | [$pod.metadata.namespace, $pod.metadata.name, .name, "privileged=true"]
    | @tsv
  '

# 5) Show containers that allow privilege escalation (or don’t specify it)
# Run on: any machine with kubectl access
kubectl get pods -A -o json | \
  jq -r '
    .items[]
    | . as $pod
    | ($pod.spec.containers // [])[]
    | select(.securityContext.allowPrivilegeEscalation != false)
    | [$pod.metadata.namespace, $pod.metadata.name, .name,
       "allowPrivilegeEscalation=" + ((.securityContext.allowPrivilegeEscalation|tostring) // "null")]
    | @tsv
  '

# 6) Show containers running as root UID (0) or with no runAsUser set
# Run on: any machine with kubectl access
kubectl get pods -A -o json | \
  jq -r '
    .items[]
    | . as $pod
    | ($pod.spec.containers // [])[]
    | . as $ctr
    | ($pod.spec.securityContext.runAsUser // .securityContext.runAsUser // "unset") as $uid
    | select($uid == 0 or $uid == "unset")
    | [$pod.metadata.namespace, $pod.metadata.name, $ctr.name, "runAsUser=" + ($uid|tostring)]
    | @tsv
  '

# 7) Show containers that can write to root filesystem (readOnlyRootFilesystem not true)
# Run on: any machine with kubectl access
kubectl get pods -A -o json | \
  jq -r '
    .items[]
    | . as $pod
    | ($pod.spec.containers // [])[]
    | select(.securityContext.readOnlyRootFilesystem != true)
    | [$pod.metadata.namespace, $pod.metadata.name, .name,
       "readOnlyRootFilesystem=" + ((.securityContext.readOnlyRootFilesystem|tostring) // "null")]
    | @tsv
  '

#!/usr/bin/env bash
# Report pods and containers without securityContext defined (pod-level or container-level)
# Run on: any machine with kubectl access and current-context pointing to the target cluster

set -euo pipefail

# Optionally scope by namespace via env var NAMESPACE (default: all namespaces)
NS_SELECTOR="${NAMESPACE:---all-namespaces}"

echo "Scanning pods for missing securityContext (pod-level and container-level)..."
echo

# 1) High‑level summary per namespace
echo "=== Summary: pods and containers missing securityContext (per namespace) ==="
kubectl get pods ${NS_SELECTOR} -o json \
  | jq -r '
    [
      .items[]
      | {
          ns: .metadata.namespace,
          pod: .metadata.name,
          podSecurityContextMissing: (has("spec") | not or (.spec | has("securityContext") | not)),
          containers: (
            (.spec.containers // [])
            | map({
                name: .name,
                missingSecCtx: (has("securityContext") | not)
              })
          ),
          initContainers: (
            (.spec.initContainers // [])
            | map({
                name: .name,
                missingSecCtx: (has("securityContext") | not)
              })
          )
        }
    ]
    | group_by(.ns)
    | map({
        namespace: .[0].ns,
        podsWithoutPodSecurityContext: (
          map(select(.podSecurityContextMissing)) | length
        ),
        containersWithoutSecurityContext: (
          [.[].containers[] | select(.missingSecCtx)] | length
        ),
        initContainersWithoutSecurityContext: (
          [.[].initContainers[] | select(.missingSecCtx)] | length
        )
      })
    | sort_by(.namespace)
    | (["namespace","pods_no_pod_sc","containers_no_sc","init_containers_no_sc"],
       (.[] | [ .namespace,
                (.podsWithoutPodSecurityContext|tostring),
                (.containersWithoutSecurityContext|tostring),
                (.initContainersWithoutSecurityContext|tostring)
       ]))
    | @tsv
  ' | column -t
echo

# 2) Detailed listing of problematic pods/containers
echo "=== Detailed: objects missing securityContext ==="
kubectl get pods ${NS_SELECTOR} -o json \
  | jq -r '
    .items[]
    | {
        ns: .metadata.namespace,
        pod: .metadata.name,
        podSecurityContextMissing: (has("spec") | not or (.spec | has("securityContext") | not)),
        containers: (
          (.spec.containers // [])
          | map(select(has("securityContext") | not) | .name)
        ),
        initContainers: (
          (.spec.initContainers // [])
          | map(select(has("securityContext") | not) | .name)
        )
      }
    | select(.podSecurityContextMissing or (.containers|length>0) or (.initContainers|length>0))
    | [
        .ns,
        .pod,
        (if .podSecurityContextMissing then "POD_NO_SECURITYCONTEXT" else "-" end),
        (if (.containers|length>0) then ("CONTAINERS_NO_SECURITYCONTEXT=" + ((.containers|join(",")))) else "-" end),
        (if (.initContainers|length>0) then ("INIT_CONTAINERS_NO_SECURITYCONTEXT=" + ((.initContainers|join(",")))) else "-" end)
      ]
    | @tsv
  ' | column -t

cat <<'EOF'

INTERPRETING RESULTS
--------------------
Any non-zero counts or lines in the "Detailed" section indicate pods or containers
without a defined securityContext and should be reviewed:

- "pods_no_pod_sc" > 0:
    Pod specs missing .spec.securityContext entirely.
- "containers_no_sc" or "init_containers_no_sc" > 0:
    One or more (init)containers in those pods lack .securityContext.

These pods/containers need manual review and, where appropriate, explicit
securityContext settings added to their manifests in line with your policy
and the CIS guidance.
EOF