Apply SecurityContext To Your Pods And Containers

kubectl get pods --all-namespaces -o jsonpath='{range .items[?(@.spec.securityContext==null)]}{.metadata.namespace}{"\t"}{.metadata.name}{"\n"}{end}'

kubectl get pods --all-namespaces -o json | \
jq -r '
  .items[]
  | {
      ns: .metadata.namespace,
      pod: .metadata.name,
      containers: [.spec.containers[]? | select(.securityContext == null) | .name],
      initContainers: [.spec.initContainers[]? | select(.securityContext == null) | .name]
    }
  | select((.containers|length) > 0 or (.initContainers|length) > 0)
  | "\(.ns)\t\(.pod)\tcontainers:\(.containers|join(","))\tinitContainers:\(.initContainers|join(","))"
'

kubectl get pod <pod-name> -n <namespace> -o yaml

kubectl get pods --all-namespaces -o json | \
jq -r '
  .items[]
  | . as $pod
  | (.spec.containers[]?, .spec.initContainers[]?)
  | select(.securityContext.privileged == true)
  | "\($pod.metadata.namespace)\t\($pod.metadata.name)\t\(.name)\tprivileged=true"
'

kubectl get pods --all-namespaces -o json | \
jq -r '
  .items[]
  | . as $pod
  | (.spec.containers[]?, .spec.initContainers[]?)
  | select(.securityContext.allowPrivilegeEscalation == true)
  | "\($pod.metadata.namespace)\t\($pod.metadata.name)\t\(.name)\tallowPrivilegeEscalation=true"
'

kubectl get pods --all-namespaces -o json | \
jq -r '
  .items[]
  | . as $pod
  | (.spec.containers[]?, .spec.initContainers[]?)
  | select(.securityContext.runAsUser == 0)
  | "\($pod.metadata.namespace)\t\($pod.metadata.name)\t\(.name)\trunAsUser=0"
'

#!/usr/bin/env bash
#
# Report pods and containers that lack SecurityContext settings
# Run on: any machine with kubectl access and KUBECONFIG set
# Requires: kubectl, jq

set -euo pipefail

# Check dependencies
for bin in kubectl jq; do
  if ! command -v "$bin" >/dev/null 2>&1; then
    echo "ERROR: $bin not found in PATH" >&2
    exit 1
  fi
done

echo "Collecting pod SecurityContext information from all namespaces..."
echo

# Summary counters
total_pods=0
pods_without_pod_sc=0
pods_with_any_container_missing_sc=0

# Header for detailed report
printf "NAMESPACE\tPOD\tPOD_SC\tCONTAINER\tCONTAINER_SC\tINIT_CONTAINER\tPROBLEM\n"

# Get all pods as JSON and iterate
kubectl get pods --all-namespaces -o json \
| jq -r '
  .items[]
  | {
      ns: .metadata.namespace,
      pod: .metadata.name,
      pod_sc: (.spec.securityContext // {}),

      # normal containers
      containers: (
        (.spec.containers // [])
        | map({
            name: .name,
            sc: (.securityContext // {})
          })
      ),

      # init containers
      init_containers: (
        (.spec.initContainers // [])
        | map({
            name: .name,
            sc: (.securityContext // {})
          })
      )
    }
  | @base64' \
| while read -r pod_b64; do
    _jq() { echo "$pod_b64" | base64 --decode | jq -r "$1"; }

    ns=$(_jq '.ns')
    pod=$(_jq '.pod')
    pod_sc_json=$(_jq '.pod_sc')

    total_pods=$((total_pods + 1))

    # Determine if pod-level securityContext is empty
    if [ "$pod_sc_json" = "{}" ] || [ "$pod_sc_json" = "null" ]; then
      pod_sc="none"
      pods_without_pod_sc=$((pods_without_pod_sc + 1))
      pod_sc_problem="POD:missing_pod_securityContext"
    else
      pod_sc="present"
      pod_sc_problem=""
    fi

    # Process regular containers
    echo "$pod_b64" | base64 --decode \
    | jq -r '.containers[]? | @base64' \
    | while read -r c_b64; do
        c_name=$(echo "$c_b64" | base64 --decode | jq -r '.name')
        c_sc_json=$(echo "$c_b64" | base64 --decode | jq -r '.sc')

        if [ "$c_sc_json" = "{}" ] || [ "$c_sc_json" = "null" ]; then
          c_sc="none"
          problem="CONTAINER:missing_container_securityContext"
          pods_with_any_container_missing_sc=$((pods_with_any_container_missing_sc + 1))
        else
          c_sc="present"
          problem="$pod_sc_problem"
        fi

        printf "%s\t%s\t%s\t%s\t%s\t%s\t%s\n" \
          "$ns" "$pod" "$pod_sc" "$c_name" "$c_sc" "no" "${problem:-}"
      done

    # Process init containers
    echo "$pod_b64" | base64 --decode \
    | jq -r '.init_containers[]? | @base64' \
    | while read -r ic_b64; do
        ic_name=$(echo "$ic_b64" | base64 --decode | jq -r '.name')
        ic_sc_json=$(echo "$ic_b64" | base64 --decode | jq -r '.sc')

        if [ "$ic_sc_json" = "{}" ] || [ "$ic_sc_json" = "null" ]; then
          ic_sc="none"
          problem="INIT_CONTAINER:missing_container_securityContext"
          pods_with_any_container_missing_sc=$((pods_with_any_container_missing_sc + 1))
        else
          ic_sc="present"
          problem="$pod_sc_problem"
        fi

        printf "%s\t%s\t%s\t%s\t%s\t%s\t%s\n" \
          "$ns" "$pod" "$pod_sc" "$ic_name" "$ic_sc" "yes" "${problem:-}"
      done

    # If pod has no containers at all, still emit one line
    if ! echo "$pod_b64" | base64 --decode | jq -e '.containers | length > 0 or .init_containers | length > 0' >/dev/null 2>&1; then
      printf "%s\t%s\t%s\t%s\t%s\t%s\t%s\n" \
        "$ns" "$pod" "$pod_sc" "-" "-" "-" "$pod_sc_problem"
    fi
  done

echo
echo "Cluster summary:"
echo "  Total pods:                             $total_pods"
echo "  Pods without pod-level SecurityContext: $pods_without_pod_sc"
echo "  Pods with any container lacking SC:     $pods_with_any_container_missing_sc"

cat <<'EOF'

How to interpret the output:

- POD_SC column:
  - "none"    => .spec.securityContext is not set on the pod (possible hardening gap).
  - "present" => Pod has a pod-level securityContext; contents must be reviewed manually.

- CONTAINER_SC column:
  - "none"    => .spec.containers[].securityContext or .spec.initContainers[].securityContext
                 is not set. This is usually a problem and should be reviewed.
  - "present" => Container has a securityContext; you must still validate it against your
                 policies and the CIS Docker/Kubernetes recommendations.

- PROBLEM column highlights obvious issues:
  - "POD:missing_pod_securityContext"
  - "CONTAINER:missing_container_securityContext"
  - "INIT_CONTAINER:missing_container_securityContext"

Any line where POD_SC = "none" or CONTAINER_SC = "none" indicates a workload that
likely needs a manual securityContext review and possible hardening.
EOF