documentation_complete: true


title: 'Apply Security Context to Your Pods and Containers'

description: |-
   Apply Security Context to your Pods and Containers

rationale: |-
   A security context defines the operating system security settings (uid, gid,
   capabilities, SELinux role, etc..) applied to a container. When designing your
   containers and pods, make sure that you configure the security context for your
   pods, containers, and volumes. A security context is a property defined in the
   deployment yaml. It controls the security parameters that will be assigned to
   the pod/container/volume. There are two levels of security context: pod level
   security context, and container level security context.

severity: medium

ocil_clause: 'SCCs in Pod definitions need review'

ocil: |-
   Review the pod definitions in your cluster and verify they have appropriate
   security contexts. OpenShift comes configured with default security context
   constraints you can use immediately to secure pods in your cluster. For more
   information on security context constraints, how to use them, and how to
   build your own, please refer to the {{{ weblink(link="https://docs.openshift.com/container-platform/4.11/authentication/managing-security-context-constraints.html", text="OpenShift security constraints documentation") }}}.

references:
    cis@ocp4: 5.7.3
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    pcidss: Req-2.2
    srg: SRG-APP-000516-CTR-001325
