diff --git a/.changeset/fluffy-files-melt.md b/.changeset/fluffy-files-melt.md new file mode 100644 index 000000000..40ac477d7 --- /dev/null +++ b/.changeset/fluffy-files-melt.md @@ -0,0 +1,5 @@ +--- +"@monokle/validation": patch +--- + +fix regression in PSS202 diff --git a/packages/validation/src/validators/pod-security-standards/rules/PSS202-privilege-escalation.ts b/packages/validation/src/validators/pod-security-standards/rules/PSS202-privilege-escalation.ts index ca99d8542..89524f9e4 100644 --- a/packages/validation/src/validators/pod-security-standards/rules/PSS202-privilege-escalation.ts +++ b/packages/validation/src/validators/pod-security-standards/rules/PSS202-privilege-escalation.ts @@ -17,7 +17,7 @@ export const privilegeEscalation = defineRule({ validatePodSpec(resources, (resource, pod, prefix) => { pod.initContainers?.forEach((container, index) => { const allowPrivilegeEscalation = container.securityContext?.allowPrivilegeEscalation; - const valid = !allowPrivilegeEscalation; + const valid = allowPrivilegeEscalation !== undefined && !allowPrivilegeEscalation; if (valid) return; @@ -28,7 +28,7 @@ export const privilegeEscalation = defineRule({ pod.ephemeralContainers?.forEach((container, index) => { const allowPrivilegeEscalation = container.securityContext?.allowPrivilegeEscalation; - const valid = !allowPrivilegeEscalation; + const valid = allowPrivilegeEscalation !== undefined && !allowPrivilegeEscalation; if (valid) return; report(resource, { @@ -38,7 +38,7 @@ export const privilegeEscalation = defineRule({ pod.containers.forEach((container, index) => { const allowPrivilegeEscalation = container.securityContext?.allowPrivilegeEscalation; - const valid = !allowPrivilegeEscalation; + const valid = allowPrivilegeEscalation !== undefined && !allowPrivilegeEscalation; if (valid) return; report(resource, {