STAC-25601: correct securityContext and required-privileges claims - #389
Open
viliakov wants to merge 2 commits into
Open
STAC-25601: correct securityContext and required-privileges claims#389viliakov wants to merge 2 commits into
viliakov wants to merge 2 commits into
Conversation
The page claimed every chart container sets the restricted securityContext, and attributed the agent's host privileges to "the agent" rather than the node agent specifically. Names the node agent and logs agent as the only agent exceptions, adds CIS-hardened RKE2 alongside Rancher-restricted PSA, and lists the three exempt containers in a table. The "starting from version v2.3.8" provenance is dropped: complete coverage only holds from the chart change in helm-charts-internal that accompanies this, and the release version is not known yet.
✅ Deploy Preview for suse-obs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
A gate-by-gate sweep of the chart turned up four more init containers that chown data volumes as root and so cannot satisfy the restricted profile. All are disabled by default, so they are listed as a follow-on note rather than in the exception table.
LouisLotter
approved these changes
Aug 21, 2026
| [NOTE] | ||
| ==== | ||
| All SUSE Observability Helm chart containers are configured with the following `securityContext` settings starting from version `v2.3.8` and onwards: | ||
| Every container in the {stackstate-product-name} and {stackstate-product-name} Agent Helm charts sets the following `securityContext` values, so that no namespace exemption is needed for them: |
There was a problem hiding this comment.
Could we describe these as effective settings and qualify the exceptions first? Some rendered containers inherit runAsNonRoot and seccompProfile from the pod, so not every container sets all four fields itself. The table also describes three workload cases but four containers, and the platform needs no exemption only while the optional volume-permission init containers remain disabled.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The page claimed every chart container sets the restricted
securityContext. It did not — the accompanying chart change inhelm-charts-internalmakes it true, and this documents what is left over.privilegedto itsprocess-agentcontainer) instead of "the agent"; the cluster agent, checks agent, RBAC agent, header injector and OTel components need none of them.restricted.Reviewer notes:
v2.3.8" provenance is dropped. Complete coverage only holds from the chart release that carries thehelm-charts-internalchange, and I do not know that version number yet — please add it if you do.== Rancher-Restricted PSA Templatebecame== Restrictive Pod Security policies. An explicit[#_rancher_restricted_psa_template]anchor keeps the old URL fragment working;#_required_privileges(linked fromk8s-suse-rancher-prime-agent-air-gapped.adoc) is unchanged.asciidoctor: renders without warnings, all anchors and xrefs resolve. No local Antora build (no node in this checkout).Tracking: https://stackstate.atlassian.net/browse/STAC-25601