Repository navigation
Assert every rendered container carries the five hardening controls #295
Description
What
Write the test 0020 names under Settled by: every container in the committed rendered trees under spec/v1/examples/{auth,data,knowledge,minimal}/rendered/ carries all five restricted controls, the postgres-exporter sidecar included, and no project document carries a hardening field.
Why
0020 records the test as still to be written. Without it, a control that one adapter or one template forgets passes every gate, which is exactly how allowPrivilegeEscalation went unrendered while the posture was called restricted.
The five controls, from chapter 10:
runAsNonRoot: truewith the images lock's numeric uidreadOnlyRootFilesystem: truecapabilities.drop: [ALL]allowPrivilegeEscalation: falseseccompProfile.type: RuntimeDefault
Dependency
Fails until #294 lands, so it lands with #294 or after it.
Acceptance
- A test fails if any rendered container misses one of the five controls, and has a negative fixture proving it does.
- A test fails if any project document authors a hardening field.
Activity
ExtraToast commentedon Oct 9, 2026
Re-scoped by Decide the fate of the open work that predates the map
The test asserts the five controls on every rendered container minus the deviations the Platform admits (a catalog Node Agent, a named capability), as #294 now states. TypeScript only, after
emf/is deleted (#99).ExtraToast commentedon Oct 21, 2026
Done by #530 (merged 2026-10-21):
lint:manifestsholds every pod template in the rendered trees to Pod Security'srestrictedprofile plus the posture's read-only root filesystem (scripts/lib/pod-security.ts), so a control the render stops emitting fails the build. The VPN sidecar is checked against the rest of the profile and may add no capability beyondNET_ADMINandNET_RAW.