Policy allows insecure seccomp profiles Affecting Deployment service in Kubernetes

Ensure spec.securityContext.seccompProfile.type is not set to Unconfined.

Example configuration:

apiVersion: v1
kind: Pod
metadata:
  name: default-pod
  labels:
    app: default-pod
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: test-container
    image: hashicorp/http-echo:1.0
    args:
    - "-text=just made some more syscalls!"
    securityContext:
      allowPrivilegeEscalation: false

Ensure seccomp.security.alpha.kubernetes.io/allowedProfileNames annotation does not contain unconfined or *.

Example configuration:

resource "kubernetes_pod_security_policy" "allowed" {
  metadata {
    name = "terraform-example"
    annotations = {
      "seccomp.security.alpha.kubernetes.io/allowedProfileNames" = "runtime/default"
    }
  }
  spec {
    privileged                 = false
    allow_privilege_escalation = false

    run_as_user {
      rule = "MustRunAsNonRoot"
    }

    se_linux {
      rule = "RunAsAny"
    }

    supplemental_groups {
      rule = "MustRunAs"
      range {
        min = 1
        max = 65535
      }
    }

    fs_group {
      rule = "MustRunAs"
      range {
        min = 1
        max = 65535
      }
    }

    read_only_root_filesystem = true
  }
}