mcp-server-semgrep/semgrep-rules/yaml/kubernetes/security/run-as-non-root-container-level-missing-security-context.test.yaml

MCP Server for Semgrep Integration - static code analysis with AI

---
apiVersion: v1
kind: Pod
# this is ok because the fix should be at pod level, different rule
# ok: run-as-non-root-container-level-missing-security-context
spec:
  containers:
    - name: nginx
      image: nginx
    - name: postgres
      image: postgres
      securityContext:
        runAsUser: 1000
        runAsGroup: 3000
        fsGroup: 2000
    - name: haproxy
      image: haproxy
---
apiVersion: v1
kind: Pod
spec:
  containers:
    - name: nginx
    # ruleid: run-as-non-root-container-level-missing-security-context
      image: nginx
    - name: postgres
      image: postgres
      # this is okay because there already is a security context, requires different fix, different rule
      # ok: run-as-non-root-container-level-missing-security-context
      securityContext:
        runAsUser: 1000
        runAsGroup: 3000
        fsGroup: 2000
    - name: haproxy
      image: haproxy
      # ok: run-as-non-root-container-level-missing-security-context
      securityContext:
        runAsNonRoot: true
---
apiVersion: v1
kind: Pod
spec:
  # this is ok because the fix should be at pod level-missing-security-context
  # ok: run-as-non-root-container-level-missing-security-context
  securityContext:
    runAsGroup: 3000
  containers:
    - name: nginx
      image: nginx
    - name: postgres
      image: postgres
      securityContext:
        runAsUser: 1000
        runAsGroup: 3000
        fsGroup: 2000
    - name: haproxy
      image: haproxy
---
apiVersion: v1
kind: Pod
spec:
  # this is ok because runAsNonRoot defined at pod level already
  # ok: run-as-non-root-container-level-missing-security-context
  securityContext:
    runAsNonRoot: true
  containers:
    - name: nginx
      image: nginx
    - name: postgres
      image: postgres
      securityContext:
        runAsUser: 1000
        runAsGroup: 3000
        fsGroup: 2000
    - name: haproxy
      image: haproxy