Back to Argo Cd

Snyk test report

docs/snyk/master/argocd-iac-namespace-install.html

3.4.026.5 KB
Original Source

| Project | manifests/namespace-install.yaml | | Path | /argo-cd/manifests/namespace-install.yaml | | Project Type | Kubernetes |

Role or ClusterRole with dangerous permissions

medium severity


  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 7] › rules[0] › resources
  • Line number: 77

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


More about this issue

Role or ClusterRole with dangerous permissions

medium severity


  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 8] › rules[4] › resources
  • Line number: 165

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


More about this issue

Role or ClusterRole with dangerous permissions

medium severity


  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 9] › rules[0] › resources
  • Line number: 200

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


More about this issue

Role or ClusterRole with dangerous permissions

medium severity


  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 10] › rules[1] › resources
  • Line number: 230

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


More about this issue

Role or ClusterRole with dangerous permissions

medium severity


  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 10] › rules[3] › resources
  • Line number: 248

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


More about this issue

Role or ClusterRole with dangerous permissions

medium severity


  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 11] › rules[0] › resources
  • Line number: 266

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


More about this issue

Role or ClusterRole with dangerous permissions

medium severity


  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 12] › rules[0] › resources
  • Line number: 288

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


More about this issue

Container could be running with outdated image

low severity


  • Public ID: SNYK-CC-K8S-42
  • Introduced through: [DocId: 39] › spec › template › spec › initContainers[secret-init] › imagePullPolicy
  • Line number: 1351

Impact

The container may run with outdated or unauthorized image

Remediation

Set imagePullPolicy attribute to Always


More about this issue

Container could be running with outdated image

low severity


  • Public ID: SNYK-CC-K8S-42
  • Introduced through: [DocId: 40] › spec › template › spec › initContainers[copyutil] › imagePullPolicy
  • Line number: 1706

Impact

The container may run with outdated or unauthorized image

Remediation

Set imagePullPolicy attribute to Always


More about this issue

Container has no CPU limit

low severity


  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 36] › input › spec › template › spec › containers[argocd-applicationset-controller] › resources › limits › cpu
  • Line number: 777

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add resources.limits.cpu field with required CPU limit value


More about this issue

Container has no CPU limit

low severity


  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 37] › input › spec › template › spec › initContainers[copyutil] › resources › limits › cpu
  • Line number: 1147

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add resources.limits.cpu field with required CPU limit value


More about this issue

Container has no CPU limit

low severity


  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 37] › input › spec › template › spec › containers[dex] › resources › limits › cpu
  • Line number: 1089

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add resources.limits.cpu field with required CPU limit value


More about this issue

Container has no CPU limit

low severity


  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 38] › input › spec › template › spec › containers[argocd-notifications-controller] › resources › limits › cpu
  • Line number: 1209

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add resources.limits.cpu field with required CPU limit value


More about this issue

Container has no CPU limit

low severity


  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 39] › input › spec › template › spec › containers[redis] › resources › limits › cpu
  • Line number: 1322

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add resources.limits.cpu field with required CPU limit value


More about this issue

Container has no CPU limit

low severity


  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 39] › input › spec › template › spec › initContainers[secret-init] › resources › limits › cpu
  • Line number: 1346

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add resources.limits.cpu field with required CPU limit value


More about this issue

Container has no CPU limit

low severity


  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 40] › input › spec › template › spec › initContainers[copyutil] › resources › limits › cpu
  • Line number: 1706

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add resources.limits.cpu field with required CPU limit value


More about this issue

Container has no CPU limit

low severity


  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 40] › input › spec › template › spec › containers[argocd-repo-server] › resources › limits › cpu
  • Line number: 1405

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add resources.limits.cpu field with required CPU limit value


More about this issue

Container has no CPU limit

low severity


  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 41] › input › spec › template › spec › containers[argocd-server] › resources › limits › cpu
  • Line number: 1801

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add resources.limits.cpu field with required CPU limit value


More about this issue

Container has no CPU limit

low severity


  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 42] › input › spec › template › spec › containers[argocd-application-controller] › resources › limits › cpu
  • Line number: 2259

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add resources.limits.cpu field with required CPU limit value


More about this issue

Container is running with multiple open ports

low severity


  • Public ID: SNYK-CC-K8S-36
  • Introduced through: [DocId: 37] › spec › template › spec › containers[dex] › ports
  • Line number: 1127

Impact

Increases the attack surface of the application and the container.

Remediation

Reduce ports count to 2


More about this issue

Container is running without liveness probe

low severity


  • Public ID: SNYK-CC-K8S-41
  • Introduced through: [DocId: 36] › spec › template › spec › containers[argocd-applicationset-controller] › livenessProbe
  • Line number: 777

Impact

Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

Remediation

Add livenessProbe attribute


More about this issue

Container is running without liveness probe

low severity


  • Public ID: SNYK-CC-K8S-41
  • Introduced through: [DocId: 37] › spec › template › spec › containers[dex] › livenessProbe
  • Line number: 1089

Impact

Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

Remediation

Add livenessProbe attribute


More about this issue

Container is running without liveness probe

low severity


  • Public ID: SNYK-CC-K8S-41
  • Introduced through: [DocId: 39] › spec › template › spec › containers[redis] › livenessProbe
  • Line number: 1322

Impact

Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

Remediation

Add livenessProbe attribute


More about this issue

Container is running without memory limit

low severity


  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 36] › input › spec › template › spec › containers[argocd-applicationset-controller] › resources › limits › memory
  • Line number: 777

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set resources.limits.memory value


More about this issue

Container is running without memory limit

low severity


  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 37] › input › spec › template › spec › containers[dex] › resources › limits › memory
  • Line number: 1089

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set resources.limits.memory value


More about this issue

Container is running without memory limit

low severity


  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 37] › input › spec › template › spec › initContainers[copyutil] › resources › limits › memory
  • Line number: 1147

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set resources.limits.memory value


More about this issue

Container is running without memory limit

low severity


  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 38] › input › spec › template › spec › containers[argocd-notifications-controller] › resources › limits › memory
  • Line number: 1209

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set resources.limits.memory value


More about this issue

Container is running without memory limit

low severity


  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 39] › input › spec › template › spec › containers[redis] › resources › limits › memory
  • Line number: 1322

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set resources.limits.memory value


More about this issue

Container is running without memory limit

low severity


  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 39] › input › spec › template › spec › initContainers[secret-init] › resources › limits › memory
  • Line number: 1346

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set resources.limits.memory value


More about this issue

Container is running without memory limit

low severity


  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 40] › input › spec › template › spec › initContainers[copyutil] › resources › limits › memory
  • Line number: 1706

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set resources.limits.memory value


More about this issue

Container is running without memory limit

low severity


  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 40] › input › spec › template › spec › containers[argocd-repo-server] › resources › limits › memory
  • Line number: 1405

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set resources.limits.memory value


More about this issue

Container is running without memory limit

low severity


  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 41] › input › spec › template › spec › containers[argocd-server] › resources › limits › memory
  • Line number: 1801

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set resources.limits.memory value


More about this issue

Container is running without memory limit

low severity


  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 42] › input › spec › template › spec › containers[argocd-application-controller] › resources › limits › memory
  • Line number: 2259

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set resources.limits.memory value


More about this issue

Container's or Pod's UID could clash with host's UID

low severity


  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 36] › input › spec › template › spec › containers[argocd-applicationset-controller] › securityContext › runAsUser
  • Line number: 1002

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set securityContext.runAsUser value to greater or equal than 10'000. SecurityContext can be set on both pod and container level. If both are set, then the container level takes precedence


More about this issue

Container's or Pod's UID could clash with host's UID

low severity


  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 37] › input › spec › template › spec › initContainers[copyutil] › securityContext › runAsUser
  • Line number: 1155

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set securityContext.runAsUser value to greater or equal than 10'000. SecurityContext can be set on both pod and container level. If both are set, then the container level takes precedence


More about this issue

Container's or Pod's UID could clash with host's UID

low severity


  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 37] › input › spec › template › spec › containers[dex] › securityContext › runAsUser
  • Line number: 1130

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set securityContext.runAsUser value to greater or equal than 10'000. SecurityContext can be set on both pod and container level. If both are set, then the container level takes precedence


More about this issue

Container's or Pod's UID could clash with host's UID

low severity


  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 38] › input › spec › template › spec › containers[argocd-notifications-controller] › securityContext › runAsUser
  • Line number: 1254

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set securityContext.runAsUser value to greater or equal than 10'000. SecurityContext can be set on both pod and container level. If both are set, then the container level takes precedence


More about this issue

Container's or Pod's UID could clash with host's UID

low severity


  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 39] › input › spec › template › spec › containers[redis] › securityContext › runAsUser
  • Line number: 1339

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set securityContext.runAsUser value to greater or equal than 10'000. SecurityContext can be set on both pod and container level. If both are set, then the container level takes precedence


More about this issue

Container's or Pod's UID could clash with host's UID

low severity


  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 39] › input › spec › template › spec › initContainers[secret-init] › securityContext › runAsUser
  • Line number: 1353

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set securityContext.runAsUser value to greater or equal than 10'000. SecurityContext can be set on both pod and container level. If both are set, then the container level takes precedence


More about this issue

Container's or Pod's UID could clash with host's UID

low severity


  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 40] › input › spec › template › spec › initContainers[copyutil] › securityContext › runAsUser
  • Line number: 1714

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set securityContext.runAsUser value to greater or equal than 10'000. SecurityContext can be set on both pod and container level. If both are set, then the container level takes precedence


More about this issue

Container's or Pod's UID could clash with host's UID

low severity


  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 40] › input › spec › template › spec › containers[argocd-repo-server] › securityContext › runAsUser
  • Line number: 1679

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set securityContext.runAsUser value to greater or equal than 10'000. SecurityContext can be set on both pod and container level. If both are set, then the container level takes precedence


More about this issue

Container's or Pod's UID could clash with host's UID

low severity


  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 41] › input › spec › template › spec › containers[argocd-server] › securityContext › runAsUser
  • Line number: 2158

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set securityContext.runAsUser value to greater or equal than 10'000. SecurityContext can be set on both pod and container level. If both are set, then the container level takes precedence


More about this issue

Container's or Pod's UID could clash with host's UID

low severity


  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 42] › input › spec › template › spec › containers[argocd-application-controller] › securityContext › runAsUser
  • Line number: 2582

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set securityContext.runAsUser value to greater or equal than 10'000. SecurityContext can be set on both pod and container level. If both are set, then the container level takes precedence


More about this issue