diff --git a/kubescape-reports/cis-v1.23-t1.0.1.html b/kubescape-reports/cis-v1.23-t1.0.1.html index 9eb54874..8aa1618e 100644 --- a/kubescape-reports/cis-v1.23-t1.0.1.html +++ b/kubescape-reports/cis-v1.23-t1.0.1.html @@ -320,10 +320,10 @@

Failed Resources:


-

Name: -recruit-postgres

-

ApiVersion: apps/v1

-

Kind: StatefulSet

-

Name: -recruit-postgres

+

Name: -gateway-vfps-test-connection

+

ApiVersion: v1

+

Kind: Pod

+

Name: -gateway-vfps-test-connection

Namespace:

@@ -340,24 +340,44 @@

Name: -recruit-postgres

- + + +
High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem=true

spec.template.spec.containers[0].securityContext.runAsGroup=1000

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

+ + +

Name: -vfps-test-connection

+

ApiVersion: v1

+

Kind: Pod

+

Name: -vfps-test-connection

+

Namespace:

+ + - - - - + + + + + + + + + + + + +
MediumCIS-5.4.1 Prefer using secrets as files over secrets as environment variablesC-0207

spec.template.spec.containers[0].env[4].name

SeverityNameDocsAssisted Remediation
HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

-

Name: -ohdsi-postgres

-

ApiVersion: apps/v1

-

Kind: StatefulSet

-

Name: -ohdsi-postgres

+

Name: -vfps-migrations-v1-3-6

+

ApiVersion: batch/v1

+

Kind: Job

+

Name: -vfps-migrations-v1-3-6

Namespace:

@@ -370,21 +390,28 @@

Name: -ohdsi-postgres

+ + + + + + + - +
HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

Medium CIS-5.4.1 Prefer using secrets as files over secrets as environment variables C-0207

spec.template.spec.containers[0].env[4].name

spec.template.spec.containers[0].env[3].name

-

Name: -mailhog

+

Name: -ohdsi-test-connection

ApiVersion: v1

-

Kind: ServiceAccount

-

Name: -mailhog

+

Kind: Pod

+

Name: -ohdsi-test-connection

Namespace:

@@ -398,10 +425,10 @@

Name: -mailhog

- - - - + + + + @@ -435,10 +462,10 @@

Name: -recruit-list

MediumCIS-5.1.6 Ensure that Service Account Tokens are only mounted where necessaryC-0190

automountServiceAccountToken=false

HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

-

Name: -vfps-postgres

+

Name: -datashield-rock

ApiVersion: apps/v1

Kind: StatefulSet

-

Name: -vfps-postgres

+

Name: -datashield-rock

Namespace:

@@ -451,21 +478,28 @@

Name: -vfps-postgres

+ + + + + + + - +
HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.containers[2].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

Medium CIS-5.4.1 Prefer using secrets as files over secrets as environment variables C-0207

spec.template.spec.containers[0].env[4].name

spec.template.spec.containers[2].env[4].name

spec.template.spec.containers[2].env[6].name

spec.template.spec.containers[2].env[8].name

-

Name: -blaze-test-connection

-

ApiVersion: v1

-

Kind: Pod

-

Name: -blaze-test-connection

+

Name: -postgresql

+

ApiVersion: apps/v1

+

Kind: StatefulSet

+

Name: -postgresql

Namespace:

@@ -482,17 +516,24 @@

Name: -blaze-test-connection

- + + + + + + + +
High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[2].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

spec.template.spec.containers[0].securityContext.runAsGroup=1000

MediumCIS-5.4.1 Prefer using secrets as files over secrets as environment variablesC-0207

spec.template.spec.containers[0].env[4].name

-

Name: -recruit-test-health-probes

-

ApiVersion: v1

-

Kind: Pod

-

Name: -recruit-test-health-probes

+

Name: -fhir-gateway-gateway

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -fhir-gateway-gateway

Namespace:

@@ -509,17 +550,24 @@

Name: -recruit-test-health-probes

- + + + + + + + +
High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[2].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

MediumCIS-5.4.1 Prefer using secrets as files over secrets as environment variablesC-0207

spec.template.spec.containers[0].env[3].name

-

Name: -recruit-notify

+

Name: -vfps

ApiVersion: apps/v1

Kind: Deployment

-

Name: -recruit-notify

+

Name: -vfps

Namespace:

@@ -543,17 +591,17 @@

Name: -recruit-notify

- +
Medium CIS-5.4.1 Prefer using secrets as files over secrets as environment variables C-0207

spec.template.spec.containers[0].env[7].name

spec.template.spec.containers[0].env[3].name

-

Name: -datashield-opal

+

Name: -postgresql

ApiVersion: apps/v1

Kind: StatefulSet

-

Name: -datashield-opal

+

Name: -postgresql

Namespace:

@@ -566,28 +614,21 @@

Name: -datashield-opal

- - - - - - - - +
HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.template.spec.containers[2].securityContext.readOnlyRootFilesystem=true

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.containers[2].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

Medium CIS-5.4.1 Prefer using secrets as files over secrets as environment variables C-0207

spec.template.spec.containers[2].env[12].name

spec.template.spec.containers[2].env[16].name

spec.template.spec.containers[2].env[1].name

spec.template.spec.containers[2].env[4].name

spec.template.spec.containers[2].env[6].name

spec.template.spec.containers[2].env[8].name

spec.template.spec.containers[0].env[4].name

-

Name: -fhir-gateway-test-connection

+

Name: -vfps-test-connection

ApiVersion: v1

Kind: Pod

-

Name: -fhir-gateway-test-connection

+

Name: -vfps-test-connection

Namespace:

@@ -611,10 +652,10 @@

Name: -fhir-gateway-test-connection

-

Name: -vfps-migrations-v1-3-6

-

ApiVersion: batch/v1

-

Kind: Job

-

Name: -vfps-migrations-v1-3-6

+

Name: -fhir-gateway-loinc-converter

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -fhir-gateway-loinc-converter

Namespace:

@@ -631,24 +672,44 @@

Name: -vfps-migrations-v1-3-6

- + + + + +
High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

+ + +

Name: -mailhog

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -mailhog

+

Namespace:

+ + + + + + + + + - - - - + + + +
SeverityNameDocsAssisted Remediation
MediumCIS-5.4.1 Prefer using secrets as files over secrets as environment variablesC-0207

spec.template.spec.containers[0].env[3].name

HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

-

Name: -fhir-gateway-gateway

+

Name: -vfps

ApiVersion: apps/v1

Kind: Deployment

-

Name: -fhir-gateway-gateway

+

Name: -vfps

Namespace:

@@ -679,10 +740,10 @@

Name: -fhir-gateway-gateway

-

Name: -vfps

+

Name: -datashield-opal

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -vfps

+

Kind: StatefulSet

+

Name: -datashield-opal

Namespace:

@@ -699,14 +760,14 @@

Name: -vfps

- + - + @@ -740,10 +801,10 @@

Name: -postgresql

High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

spec.template.spec.containers[2].securityContext.readOnlyRootFilesystem=true

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.containers[2].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

Medium CIS-5.4.1 Prefer using secrets as files over secrets as environment variables C-0207

spec.template.spec.containers[0].env[3].name

spec.template.spec.containers[2].env[12].name

spec.template.spec.containers[2].env[16].name

spec.template.spec.containers[2].env[1].name

spec.template.spec.containers[2].env[4].name

spec.template.spec.containers[2].env[6].name

spec.template.spec.containers[2].env[8].name

-

Name: -postgresql

+

Name: -recruit-postgres

ApiVersion: apps/v1

Kind: StatefulSet

-

Name: -postgresql

+

Name: -recruit-postgres

Namespace:

@@ -756,6 +817,13 @@

Name: -postgresql

+ + + + + + + @@ -767,10 +835,10 @@

Name: -postgresql

HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem=true

spec.template.spec.containers[0].securityContext.runAsGroup=1000

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

Medium CIS-5.4.1 Prefer using secrets as files over secrets as environment variables
-

Name: -vfps-test-connection

-

ApiVersion: v1

-

Kind: Pod

-

Name: -vfps-test-connection

+

Name: -ohdsi-atlas

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -ohdsi-atlas

Namespace:

@@ -787,17 +855,17 @@

Name: -vfps-test-connection

- +
High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem=true

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

-

Name: -datashield-test-connection

+

Name: -fhir-pseudonymizer-test-connection

ApiVersion: v1

Kind: Pod

-

Name: -datashield-test-connection

+

Name: -fhir-pseudonymizer-test-connection

Namespace:

@@ -821,10 +889,10 @@

Name: -datashield-test-connection

-

Name: -fhir-pseudonymizer

+

Name: -recruit-notify

ApiVersion: apps/v1

Kind: Deployment

-

Name: -fhir-pseudonymizer

+

Name: -recruit-notify

Namespace:

@@ -844,14 +912,21 @@

Name: -fhir-pseudonymizer

+ + + + + + +

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

MediumCIS-5.4.1 Prefer using secrets as files over secrets as environment variablesC-0207

spec.template.spec.containers[0].env[7].name

-

Name: -fhir-pseudonymizer

+

Name: -gateway-vfps

ApiVersion: apps/v1

Kind: Deployment

-

Name: -fhir-pseudonymizer

+

Name: -gateway-vfps

Namespace:

@@ -871,14 +946,21 @@

Name: -fhir-pseudonymizer

+ + + + + + +

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

MediumCIS-5.4.1 Prefer using secrets as files over secrets as environment variablesC-0207

spec.template.spec.containers[0].env[3].name

-

Name: -fhir-gateway-loinc-converter

-

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -fhir-gateway-loinc-converter

+

Name: -hapi-fhir-jpaserver-test-endpoints

+

ApiVersion: v1

+

Kind: Pod

+

Name: -hapi-fhir-jpaserver-test-endpoints

Namespace:

@@ -895,17 +977,17 @@

Name: -fhir-gateway-loinc-converter

- +
High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[2].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

-

Name: -vfps-migrations-v1-3-5

-

ApiVersion: batch/v1

-

Kind: Job

-

Name: -vfps-migrations-v1-3-5

+

Name: -ohdsi-webapi

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -ohdsi-webapi

Namespace:

@@ -922,24 +1004,24 @@

Name: -vfps-migrations-v1-3-5

- + - +
High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

Medium CIS-5.4.1 Prefer using secrets as files over secrets as environment variables C-0207

spec.template.spec.containers[0].env[3].name

spec.template.spec.containers[0].env[14].name

spec.template.spec.containers[0].env[4].name

-

Name: -fhir-pseudonymizer-test-connection

+

Name: -blaze-test-connection

ApiVersion: v1

Kind: Pod

-

Name: -fhir-pseudonymizer-test-connection

+

Name: -blaze-test-connection

Namespace:

@@ -956,17 +1038,17 @@

Name: -fhir-pseudonymizer-test-connection

- +
High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[2].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

-

Name: -recruit-query

+

Name: -postgresql

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -recruit-query

+

Kind: StatefulSet

+

Name: -postgresql

Namespace:

@@ -979,28 +1061,21 @@

Name: -recruit-query

- - - - - - - - +
HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

Medium CIS-5.4.1 Prefer using secrets as files over secrets as environment variables C-0207

spec.template.spec.containers[0].env[3].name

spec.template.spec.containers[0].env[4].name

-

Name: -vfps-test-connection

-

ApiVersion: v1

-

Kind: Pod

-

Name: -vfps-test-connection

+

Name: -blaze

+

ApiVersion: apps/v1

+

Kind: StatefulSet

+

Name: -blaze

Namespace:

@@ -1017,17 +1092,17 @@

Name: -vfps-test-connection

- +
High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

-

Name: -gateway-vfps-test-connection

-

ApiVersion: v1

-

Kind: Pod

-

Name: -gateway-vfps-test-connection

+

Name: -fhir-pseudonymizer

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -fhir-pseudonymizer

Namespace:

@@ -1044,17 +1119,17 @@

Name: -gateway-vfps-test-connection

- +
High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

-

Name: -vfps

-

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -vfps

+

Name: -vfps-migrations-v1-3-5

+

ApiVersion: batch/v1

+

Kind: Job

+

Name: -vfps-migrations-v1-3-5

Namespace:

@@ -1071,7 +1146,7 @@

Name: -vfps

- + @@ -1085,10 +1160,10 @@

Name: -vfps

High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

-

Name: -gateway-vfps

+

Name: -hapi-fhir-jpaserver

ApiVersion: apps/v1

Kind: Deployment

-

Name: -gateway-vfps

+

Name: -hapi-fhir-jpaserver

Namespace:

@@ -1112,17 +1187,17 @@

Name: -gateway-vfps

- +
Medium CIS-5.4.1 Prefer using secrets as files over secrets as environment variables C-0207

spec.template.spec.containers[0].env[3].name

spec.template.spec.containers[0].env[2].name

-

Name: -ohdsi-atlas

+

Name: -vfps

ApiVersion: apps/v1

Kind: Deployment

-

Name: -ohdsi-atlas

+

Name: -vfps

Namespace:

@@ -1139,17 +1214,24 @@

Name: -ohdsi-atlas

- + + + + + + + +
High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem=true

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

MediumCIS-5.4.1 Prefer using secrets as files over secrets as environment variablesC-0207

spec.template.spec.containers[0].env[3].name

-

Name: -ohdsi-test-connection

-

ApiVersion: v1

-

Kind: Pod

-

Name: -ohdsi-test-connection

+

Name: -fhir-pseudonymizer

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -fhir-pseudonymizer

Namespace:

@@ -1166,17 +1248,17 @@

Name: -ohdsi-test-connection

- +
High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

-

Name: -postgresql

-

ApiVersion: apps/v1

-

Kind: StatefulSet

-

Name: -postgresql

+

Name: -recruit-test-health-probes

+

ApiVersion: v1

+

Kind: Pod

+

Name: -recruit-test-health-probes

Namespace:

@@ -1190,20 +1272,20 @@

Name: -postgresql

- - - - + + + +
MediumCIS-5.4.1 Prefer using secrets as files over secrets as environment variablesC-0207

spec.template.spec.containers[0].env[4].name

HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[2].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

-

Name: -gateway-vfps-migrations-v1-3-5

+

Name: -vfps-migrations-v1-3-6

ApiVersion: batch/v1

Kind: Job

-

Name: -gateway-vfps-migrations-v1-3-5

+

Name: -vfps-migrations-v1-3-6

Namespace:

@@ -1234,10 +1316,10 @@

Name: -gateway-vfps-migrations-v1-3-5

-

Name: -datashield-rock

-

ApiVersion: apps/v1

-

Kind: StatefulSet

-

Name: -datashield-rock

+

Name: -fhir-gateway-test-connection

+

ApiVersion: v1

+

Kind: Pod

+

Name: -fhir-gateway-test-connection

Namespace:

@@ -1254,24 +1336,17 @@

Name: -datashield-rock

- - - - - - - - +
High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.containers[2].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

MediumCIS-5.4.1 Prefer using secrets as files over secrets as environment variablesC-0207

spec.template.spec.containers[2].env[4].name

spec.template.spec.containers[2].env[6].name

spec.template.spec.containers[2].env[8].name

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

-

Name: -postgresql

+

Name: -vfps-postgres

ApiVersion: apps/v1

Kind: StatefulSet

-

Name: -postgresql

+

Name: -vfps-postgres

Namespace:

@@ -1284,13 +1359,6 @@

Name: -postgresql

- - - - - - - @@ -1302,10 +1370,10 @@

Name: -postgresql

HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.template.spec.containers[0].securityContext.runAsGroup=1000

Medium CIS-5.4.1 Prefer using secrets as files over secrets as environment variables
-

Name: -vfps

+

Name: -recruit-query

ApiVersion: apps/v1

Kind: Deployment

-

Name: -vfps

+

Name: -recruit-query

Namespace:

@@ -1336,10 +1404,10 @@

Name: -vfps

-

Name: -ohdsi-webapi

+

Name: -fhir-pseudonymizer

ApiVersion: apps/v1

Kind: Deployment

-

Name: -ohdsi-webapi

+

Name: -fhir-pseudonymizer

Namespace:

@@ -1359,21 +1427,14 @@

Name: -ohdsi-webapi

- - - - - - -

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

MediumCIS-5.4.1 Prefer using secrets as files over secrets as environment variablesC-0207

spec.template.spec.containers[0].env[14].name

spec.template.spec.containers[0].env[4].name

-

Name: -fhir-pseudonymizer-test-connection

+

Name: -vfps-test-connection

ApiVersion: v1

Kind: Pod

-

Name: -fhir-pseudonymizer-test-connection

+

Name: -vfps-test-connection

Namespace:

@@ -1397,37 +1458,10 @@

Name: -fhir-pseudonymizer-test-connection

-

Name: -mailhog

+

Name: -postgresql

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -mailhog

-

Namespace:

- - - - - - - - - - - - - - - - - - - -
SeverityNameDocsAssisted Remediation
HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

- - -

Name: -vfps-migrations-v1-3-6

-

ApiVersion: batch/v1

-

Kind: Job

-

Name: -vfps-migrations-v1-3-6

+

Kind: StatefulSet

+

Name: -postgresql

Namespace:

@@ -1440,55 +1474,21 @@

Name: -vfps-migrations-v1-3-6

- - - - - - - - - - - -
HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

Medium CIS-5.4.1 Prefer using secrets as files over secrets as environment variables C-0207

spec.template.spec.containers[0].env[3].name

- - -

Name: -hapi-fhir-jpaserver-test-endpoints

-

ApiVersion: v1

-

Kind: Pod

-

Name: -hapi-fhir-jpaserver-test-endpoints

-

Namespace:

- - - - - - - - - - - - - - - - +
SeverityNameDocsAssisted Remediation
HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[2].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

spec.template.spec.containers[0].env[4].name

-

Name: -vfps-test-connection

+

Name: -fhir-pseudonymizer-test-connection

ApiVersion: v1

Kind: Pod

-

Name: -vfps-test-connection

+

Name: -fhir-pseudonymizer-test-connection

Namespace:

@@ -1539,10 +1539,10 @@

Name: -postgresql

-

Name: -hapi-fhir-jpaserver

-

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -hapi-fhir-jpaserver

+

Name: -gateway-vfps-migrations-v1-3-5

+

ApiVersion: batch/v1

+

Kind: Job

+

Name: -gateway-vfps-migrations-v1-3-5

Namespace:

@@ -1559,24 +1559,24 @@

Name: -hapi-fhir-jpaserver

- + - +
High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

Medium CIS-5.4.1 Prefer using secrets as files over secrets as environment variables C-0207

spec.template.spec.containers[0].env[2].name

spec.template.spec.containers[0].env[3].name

-

Name: -fhir-pseudonymizer

-

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -fhir-pseudonymizer

+

Name: -mailhog

+

ApiVersion: v1

+

Kind: ServiceAccount

+

Name: -mailhog

Namespace:

@@ -1590,20 +1590,20 @@

Name: -fhir-pseudonymizer

- - - - + + + +
HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroup=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

MediumCIS-5.1.6 Ensure that Service Account Tokens are only mounted where necessaryC-0190

automountServiceAccountToken=false

-

Name: -fhir-pseudonymizer-test-connection

-

ApiVersion: v1

-

Kind: Pod

-

Name: -fhir-pseudonymizer-test-connection

+

Name: -ohdsi-postgres

+

ApiVersion: apps/v1

+

Kind: StatefulSet

+

Name: -ohdsi-postgres

Namespace:

@@ -1617,20 +1617,20 @@

Name: -fhir-pseudonymizer-test-connection

- - - - + + + +
HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

MediumCIS-5.4.1 Prefer using secrets as files over secrets as environment variablesC-0207

spec.template.spec.containers[0].env[4].name

-

Name: -postgresql

-

ApiVersion: apps/v1

-

Kind: StatefulSet

-

Name: -postgresql

+

Name: -fhir-pseudonymizer-test-connection

+

ApiVersion: v1

+

Kind: Pod

+

Name: -fhir-pseudonymizer-test-connection

Namespace:

@@ -1644,20 +1644,20 @@

Name: -postgresql

- - - - + + + +
MediumCIS-5.4.1 Prefer using secrets as files over secrets as environment variablesC-0207

spec.template.spec.containers[0].env[4].name

HighCIS-5.7.3 Apply Security Context to Your Pods and ContainersC-0211

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

-

Name: -blaze

-

ApiVersion: apps/v1

-

Kind: StatefulSet

-

Name: -blaze

+

Name: -datashield-test-connection

+

ApiVersion: v1

+

Kind: Pod

+

Name: -datashield-test-connection

Namespace:

@@ -1674,7 +1674,7 @@

Name: -blaze

- + diff --git a/kubescape-reports/nsa.html b/kubescape-reports/nsa.html index 4ce773b2..d98b29c9 100644 --- a/kubescape-reports/nsa.html +++ b/kubescape-reports/nsa.html @@ -284,10 +284,10 @@

Failed Resources:


-

Name: -recruit-postgres

-

ApiVersion: apps/v1

-

Kind: StatefulSet

-

Name: -recruit-postgres

+

Name: -gateway-vfps-test-connection

+

ApiVersion: v1

+

Kind: Pod

+

Name: -gateway-vfps-test-connection

Namespace:

High CIS-5.7.3 Apply Security Context to Your Pods and Containers C-0211

spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.template.spec.securityContext.fsGroupChangePolicy=Always

spec.template.spec.securityContext.sysctls.name=YOUR_VALUE

spec.template.spec.securityContext.sysctls.value=YOUR_VALUE

spec.template.spec.securityContext.supplementalGroups=YOUR_VALUE

spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE

spec.containers[1].securityContext.seLinuxOptions=YOUR_VALUE

spec.securityContext.sysctls.name=YOUR_VALUE

spec.securityContext.sysctls.value=YOUR_VALUE

spec.securityContext.supplementalGroups=YOUR_VALUE

@@ -307,42 +307,14 @@

Name: -recruit-postgres

- - - - - - - - - - - - - - - - - - - - - - - - - - - -
HighEnsure CPU limits are setC-0270

spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE

MediumNon-root containersC-0013

spec.template.spec.containers[0].securityContext.runAsGroup=1000

LowImmutable container filesystemC-0017

spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem=true

-

Name: -postgresql

+

Name: -fhir-pseudonymizer

ApiVersion: apps/v1

-

Kind: StatefulSet

-

Name: -postgresql

+

Kind: Deployment

+

Name: -fhir-pseudonymizer

Namespace:

@@ -355,35 +327,21 @@

Name: -postgresql

- - - - - - - - - - - - - - - - - + + +
HighEnsure CPU limits are setC-0270

spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE

MediumNon-root containersC-0013

spec.template.spec.containers[0].securityContext.runAsGroup=1000

Ingress and Egress blockedC-0030
-

Name: -vfps-test-connection

-

ApiVersion: v1

-

Kind: Pod

-

Name: -vfps-test-connection

+

Name: -mailhog

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -mailhog

Namespace:

@@ -403,14 +361,28 @@

Name: -vfps-test-connection

+ + + + + + + + + + + + + +
HighEnsure CPU limits are setC-0270

spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE

-

Name: -gateway-vfps

-

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -gateway-vfps

+

Name: -gateway-vfps-migrations-v1-3-5

+

ApiVersion: batch/v1

+

Kind: Job

+

Name: -gateway-vfps-migrations-v1-3-5

Namespace:

@@ -434,10 +406,10 @@

Name: -gateway-vfps

-

Name: -vfps

+

Name: -hapi-fhir-jpaserver

ApiVersion: apps/v1

Kind: Deployment

-

Name: -vfps

+

Name: -hapi-fhir-jpaserver

Namespace:

@@ -457,14 +429,28 @@

Name: -vfps

+ + + + + + + + + + + + + +
HighEnsure CPU limits are setC-0270

spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE

-

Name: -gateway-vfps-migrations-v1-3-5

-

ApiVersion: batch/v1

-

Kind: Job

-

Name: -gateway-vfps-migrations-v1-3-5

+

Name: -hapi-fhir-jpaserver-test-endpoints

+

ApiVersion: v1

+

Kind: Pod

+

Name: -hapi-fhir-jpaserver-test-endpoints

Namespace:

@@ -484,14 +470,28 @@

Name: -gateway-vfps-migrations-v1-3-5

+ + + + + + + + + + + + + +
HighEnsure CPU limits are setC-0270

spec.containers[0].resources.limits.cpu=YOUR_VALUE

spec.containers[2].resources.limits.cpu=YOUR_VALUE

spec.containers[1].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.containers[0].resources.limits.memory=YOUR_VALUE

spec.containers[2].resources.limits.memory=YOUR_VALUE

spec.containers[1].resources.limits.memory=YOUR_VALUE

-

Name: -vfps

+

Name: -recruit-postgres

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -vfps

+

Kind: StatefulSet

+

Name: -recruit-postgres

Namespace:

@@ -504,6 +504,20 @@

Name: -vfps

+ + + + + + + + + + + + + + @@ -529,10 +543,10 @@

Name: -vfps

MediumNon-root containersC-0013

spec.template.spec.containers[0].securityContext.runAsGroup=1000

LowImmutable container filesystemC-0017

spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem=true

Medium Ingress and Egress blocked
-

Name: -fhir-pseudonymizer

+

Name: -vfps

ApiVersion: apps/v1

Kind: Deployment

-

Name: -fhir-pseudonymizer

+

Name: -vfps

Namespace:

@@ -556,10 +570,10 @@

Name: -fhir-pseudonymizer

-

Name: -datashield-test-connection

-

ApiVersion: v1

-

Kind: Pod

-

Name: -datashield-test-connection

+

Name: -fhir-pseudonymizer

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -fhir-pseudonymizer

Namespace:

@@ -579,14 +593,28 @@

Name: -datashield-test-connection

+ + + + + + + + + + + + + +
HighEnsure CPU limits are setC-0270

spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE

-

Name: -fhir-gateway-test-connection

-

ApiVersion: v1

-

Kind: Pod

-

Name: -fhir-gateway-test-connection

+

Name: -vfps

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -vfps

Namespace:

@@ -606,14 +634,28 @@

Name: -fhir-gateway-test-connection

+ + + + + + + + + + + + + +
HighEnsure CPU limits are setC-0270

spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE

-

Name: -gateway-vfps-test-connection

-

ApiVersion: v1

-

Kind: Pod

-

Name: -gateway-vfps-test-connection

+

Name: -vfps-migrations-v1-3-6

+

ApiVersion: batch/v1

+

Kind: Job

+

Name: -vfps-migrations-v1-3-6

Namespace:

@@ -637,10 +679,10 @@

Name: -gateway-vfps-test-connection

-

Name: -datashield-opal

-

ApiVersion: apps/v1

-

Kind: StatefulSet

-

Name: -datashield-opal

+

Name: -datashield-test-connection

+

ApiVersion: v1

+

Kind: Pod

+

Name: -datashield-test-connection

Namespace:

@@ -660,21 +702,14 @@

Name: -datashield-opal

- - - - - - -
LowImmutable container filesystemC-0017

spec.template.spec.containers[2].securityContext.readOnlyRootFilesystem=true

-

Name: -fhir-gateway-loinc-converter

-

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -fhir-gateway-loinc-converter

+

Name: -vfps-migrations-v1-3-6

+

ApiVersion: batch/v1

+

Kind: Job

+

Name: -vfps-migrations-v1-3-6

Namespace:

@@ -698,10 +733,10 @@

Name: -fhir-gateway-loinc-converter

-

Name: -ohdsi-webapi

+

Name: -recruit-notify

ApiVersion: apps/v1

Kind: Deployment

-

Name: -ohdsi-webapi

+

Name: -recruit-notify

Namespace:

@@ -739,10 +774,10 @@

Name: -ohdsi-webapi

-

Name: -vfps

+

Name: -fhir-pseudonymizer

ApiVersion: apps/v1

Kind: Deployment

-

Name: -vfps

+

Name: -fhir-pseudonymizer

Namespace:

@@ -766,10 +801,10 @@

Name: -vfps

-

Name: -fhir-pseudonymizer

-

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -fhir-pseudonymizer

+

Name: -vfps-migrations-v1-3-5

+

ApiVersion: batch/v1

+

Kind: Job

+

Name: -vfps-migrations-v1-3-5

Namespace:

@@ -807,10 +842,10 @@

Name: -fhir-pseudonymizer

-

Name: -mailhog

-

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -mailhog

+

Name: -fhir-pseudonymizer-test-connection

+

ApiVersion: v1

+

Kind: Pod

+

Name: -fhir-pseudonymizer-test-connection

Namespace:

@@ -830,28 +865,14 @@

Name: -mailhog

- - - - - - - - - - - - - -
HighEnsure CPU limits are setC-0270

spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE

-

Name: -vfps-test-connection

-

ApiVersion: v1

-

Kind: Pod

-

Name: -vfps-test-connection

+

Name: -gateway-vfps

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -gateway-vfps

Namespace:

@@ -875,10 +896,10 @@

Name: -vfps-test-connection

-

Name: -fhir-pseudonymizer-test-connection

+

Name: -mailhog

ApiVersion: v1

-

Kind: Pod

-

Name: -fhir-pseudonymizer-test-connection

+

Kind: ServiceAccount

+

Name: -mailhog

Namespace:

@@ -893,33 +914,46 @@

Name: -fhir-pseudonymizer-test-connection

- - - + + + + +
MediumIngress and Egress blockedC-0030Automatic mapping of service accountC-0034

automountServiceAccountToken=false

+ + +

Name: -blaze

+

ApiVersion: apps/v1

+

Kind: StatefulSet

+

Name: -blaze

+

Namespace:

+ + - - - - + + + + + + - - - - + + + +
HighEnsure CPU limits are setC-0270

spec.containers[1].resources.limits.cpu=YOUR_VALUE

spec.containers[0].resources.limits.cpu=YOUR_VALUE

SeverityNameDocsAssisted Remediation
HighEnsure memory limits are setC-0271

spec.containers[1].resources.limits.memory=YOUR_VALUE

spec.containers[0].resources.limits.memory=YOUR_VALUE

MediumIngress and Egress blockedC-0030
-

Name: -vfps-test-connection

+

Name: -recruit-test-health-probes

ApiVersion: v1

Kind: Pod

-

Name: -vfps-test-connection

+

Name: -recruit-test-health-probes

Namespace:

@@ -943,24 +977,24 @@

Name: -vfps-test-connection

- + - +
High Ensure CPU limits are set C-0270

spec.containers[0].resources.limits.cpu=YOUR_VALUE

spec.containers[1].resources.limits.cpu=YOUR_VALUE

spec.containers[0].resources.limits.cpu=YOUR_VALUE

spec.containers[2].resources.limits.cpu=YOUR_VALUE

spec.containers[1].resources.limits.cpu=YOUR_VALUE

High Ensure memory limits are set C-0271

spec.containers[0].resources.limits.memory=YOUR_VALUE

spec.containers[1].resources.limits.memory=YOUR_VALUE

spec.containers[0].resources.limits.memory=YOUR_VALUE

spec.containers[2].resources.limits.memory=YOUR_VALUE

spec.containers[1].resources.limits.memory=YOUR_VALUE

-

Name: -vfps-migrations-v1-3-6

-

ApiVersion: batch/v1

-

Kind: Job

-

Name: -vfps-migrations-v1-3-6

+

Name: -ohdsi-atlas

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -ohdsi-atlas

Namespace:

@@ -973,6 +1007,13 @@

Name: -vfps-migrations-v1-3-6

+ + + + + + + @@ -980,14 +1021,28 @@

Name: -vfps-migrations-v1-3-6

+ + + + + + + + + + + + + +
LowImmutable container filesystemC-0017

spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem=true

Medium Ingress and Egress blocked
HighEnsure CPU limits are setC-0270

spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE

-

Name: -blaze-test-connection

+

Name: -ohdsi-test-connection

ApiVersion: v1

Kind: Pod

-

Name: -blaze-test-connection

+

Name: -ohdsi-test-connection

Namespace:

@@ -1007,14 +1062,28 @@

Name: -blaze-test-connection

+ + + + + + + + + + + + + +
HighEnsure CPU limits are setC-0270

spec.containers[1].resources.limits.cpu=YOUR_VALUE

spec.containers[0].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.containers[1].resources.limits.memory=YOUR_VALUE

spec.containers[0].resources.limits.memory=YOUR_VALUE

-

Name: -fhir-gateway-gateway

-

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -fhir-gateway-gateway

+

Name: -vfps-test-connection

+

ApiVersion: v1

+

Kind: Pod

+

Name: -vfps-test-connection

Namespace:

@@ -1038,10 +1107,10 @@

Name: -fhir-gateway-gateway

-

Name: -datashield-rock

+

Name: -fhir-gateway-gateway

ApiVersion: apps/v1

-

Kind: StatefulSet

-

Name: -datashield-rock

+

Kind: Deployment

+

Name: -fhir-gateway-gateway

Namespace:

@@ -1065,10 +1134,10 @@

Name: -datashield-rock

-

Name: -recruit-query

-

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -recruit-query

+

Name: -blaze-test-connection

+

ApiVersion: v1

+

Kind: Pod

+

Name: -blaze-test-connection

Namespace:

@@ -1088,28 +1157,14 @@

Name: -recruit-query

- - - - - - - - - - - - - -
HighEnsure CPU limits are setC-0270

spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE

-

Name: -recruit-notify

-

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -recruit-notify

+

Name: -fhir-pseudonymizer-test-connection

+

ApiVersion: v1

+

Kind: Pod

+

Name: -fhir-pseudonymizer-test-connection

Namespace:

@@ -1129,28 +1184,14 @@

Name: -recruit-notify

- - - - - - - - - - - - - -
HighEnsure CPU limits are setC-0270

spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE

-

Name: -fhir-pseudonymizer-test-connection

-

ApiVersion: v1

-

Kind: Pod

-

Name: -fhir-pseudonymizer-test-connection

+

Name: -vfps

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -vfps

Namespace:

@@ -1174,10 +1215,10 @@

Name: -fhir-pseudonymizer-test-connection

-

Name: -recruit-list

+

Name: -recruit-query

ApiVersion: apps/v1

Kind: Deployment

-

Name: -recruit-list

+

Name: -recruit-query

Namespace:

@@ -1190,13 +1231,6 @@

Name: -recruit-list

- - - - - - - @@ -1222,10 +1256,10 @@

Name: -recruit-list

HighApplications credentials in configuration filesC-0012

spec.template.spec.containers[0].env[1].name

spec.template.spec.containers[0].env[1].value

Medium Ingress and Egress blocked
-

Name: -hapi-fhir-jpaserver-test-endpoints

-

ApiVersion: v1

-

Kind: Pod

-

Name: -hapi-fhir-jpaserver-test-endpoints

+

Name: -recruit-list

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -recruit-list

Namespace:

@@ -1249,24 +1283,31 @@

Name: -hapi-fhir-jpaserver-test-endpoints

- + - + + + + + + + +
High Ensure CPU limits are set C-0270

spec.containers[0].resources.limits.cpu=YOUR_VALUE

spec.containers[2].resources.limits.cpu=YOUR_VALUE

spec.containers[1].resources.limits.cpu=YOUR_VALUE

spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE

High Ensure memory limits are set C-0271

spec.containers[0].resources.limits.memory=YOUR_VALUE

spec.containers[2].resources.limits.memory=YOUR_VALUE

spec.containers[1].resources.limits.memory=YOUR_VALUE

spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE

HighApplications credentials in configuration filesC-0012

spec.template.spec.containers[0].env[1].name

spec.template.spec.containers[0].env[1].value

-

Name: -blaze

+

Name: -ohdsi-webapi

ApiVersion: apps/v1

-

Kind: StatefulSet

-

Name: -blaze

+

Kind: Deployment

+

Name: -ohdsi-webapi

Namespace:

@@ -1286,41 +1327,28 @@

Name: -blaze

- -
- - -

Name: -mailhog

-

ApiVersion: v1

-

Kind: ServiceAccount

-

Name: -mailhog

-

Namespace:

- - - - - - + + + + - - - - - - + + + +
SeverityNameDocsAssisted RemediationHighEnsure CPU limits are setC-0270

spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE

MediumAutomatic mapping of service accountC-0034

automountServiceAccountToken=false

HighEnsure memory limits are setC-0271

spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE

-

Name: -vfps-migrations-v1-3-5

-

ApiVersion: batch/v1

-

Kind: Job

-

Name: -vfps-migrations-v1-3-5

+

Name: -fhir-pseudonymizer-test-connection

+

ApiVersion: v1

+

Kind: Pod

+

Name: -fhir-pseudonymizer-test-connection

Namespace:

@@ -1344,24 +1372,24 @@

Name: -vfps-migrations-v1-3-5

- + - +
High Ensure CPU limits are set C-0270

spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE

spec.containers[1].resources.limits.cpu=YOUR_VALUE

spec.containers[0].resources.limits.cpu=YOUR_VALUE

High Ensure memory limits are set C-0271

spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE

spec.containers[1].resources.limits.memory=YOUR_VALUE

spec.containers[0].resources.limits.memory=YOUR_VALUE

-

Name: -fhir-pseudonymizer

-

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -fhir-pseudonymizer

+

Name: -vfps-test-connection

+

ApiVersion: v1

+

Kind: Pod

+

Name: -vfps-test-connection

Namespace:

@@ -1385,10 +1413,10 @@

Name: -fhir-pseudonymizer

-

Name: -ohdsi-atlas

+

Name: -datashield-opal

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -ohdsi-atlas

+

Kind: StatefulSet

+

Name: -datashield-opal

Namespace:

@@ -1401,6 +1429,13 @@

Name: -ohdsi-atlas

+ + + + + + + @@ -1408,35 +1443,14 @@

Name: -ohdsi-atlas

- - - - - - - - - - - - - - - - - - - - -
LowImmutable container filesystemC-0017

spec.template.spec.containers[2].securityContext.readOnlyRootFilesystem=true

Medium Ingress and Egress blocked
HighEnsure CPU limits are setC-0270

spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE

LowImmutable container filesystemC-0017

spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem=true

-

Name: -recruit-test-health-probes

+

Name: -fhir-gateway-test-connection

ApiVersion: v1

Kind: Pod

-

Name: -recruit-test-health-probes

+

Name: -fhir-gateway-test-connection

Namespace:

@@ -1456,28 +1470,14 @@

Name: -recruit-test-health-probes

- - - - - - - - - - - - - -
HighEnsure CPU limits are setC-0270

spec.containers[0].resources.limits.cpu=YOUR_VALUE

spec.containers[2].resources.limits.cpu=YOUR_VALUE

spec.containers[1].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.containers[0].resources.limits.memory=YOUR_VALUE

spec.containers[2].resources.limits.memory=YOUR_VALUE

spec.containers[1].resources.limits.memory=YOUR_VALUE

-

Name: -ohdsi-test-connection

-

ApiVersion: v1

-

Kind: Pod

-

Name: -ohdsi-test-connection

+

Name: -fhir-gateway-loinc-converter

+

ApiVersion: apps/v1

+

Kind: Deployment

+

Name: -fhir-gateway-loinc-converter

Namespace:

@@ -1497,28 +1497,14 @@

Name: -ohdsi-test-connection

- - - - - - - - - - - - - -
HighEnsure CPU limits are setC-0270

spec.containers[1].resources.limits.cpu=YOUR_VALUE

spec.containers[0].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.containers[1].resources.limits.memory=YOUR_VALUE

spec.containers[0].resources.limits.memory=YOUR_VALUE

-

Name: -fhir-pseudonymizer-test-connection

-

ApiVersion: v1

-

Kind: Pod

-

Name: -fhir-pseudonymizer-test-connection

+

Name: -datashield-rock

+

ApiVersion: apps/v1

+

Kind: StatefulSet

+

Name: -datashield-rock

Namespace:

@@ -1542,10 +1528,10 @@

Name: -fhir-pseudonymizer-test-connection

-

Name: -vfps-migrations-v1-3-6

-

ApiVersion: batch/v1

-

Kind: Job

-

Name: -vfps-migrations-v1-3-6

+

Name: -vfps-test-connection

+

ApiVersion: v1

+

Kind: Pod

+

Name: -vfps-test-connection

Namespace:

@@ -1565,14 +1551,28 @@

Name: -vfps-migrations-v1-3-6

+ + + + + + + + + + + + + +
HighEnsure CPU limits are setC-0270

spec.containers[0].resources.limits.cpu=YOUR_VALUE

spec.containers[1].resources.limits.cpu=YOUR_VALUE

HighEnsure memory limits are setC-0271

spec.containers[0].resources.limits.memory=YOUR_VALUE

spec.containers[1].resources.limits.memory=YOUR_VALUE

-

Name: -hapi-fhir-jpaserver

+

Name: -postgresql

ApiVersion: apps/v1

-

Kind: Deployment

-

Name: -hapi-fhir-jpaserver

+

Kind: StatefulSet

+

Name: -postgresql

Namespace:

@@ -1587,9 +1587,9 @@

Name: -hapi-fhir-jpaserver

- - - + + +
MediumIngress and Egress blockedC-0030Non-root containersC-0013

spec.template.spec.containers[0].securityContext.runAsGroup=1000