Missing seccompProfile in securityContext (CIS Compliance - Prisma Cloud Finding)

[jagtapa]

Description

Prisma Cloud has reported a critical severity finding for one of our GKE workloads indicating that the default seccomp profile is not enforced.

---

Finding Details

• Container: frontend
• Image: frontend:v0.15.0-gke.12
• Severity: Critical
• Control: Do not disable default seccomp profile
• Provider: GCP (GKE)
• Reported By: Prisma Cloud Defender

---

Issue

Although securityContext is defined in the deployment YAML, the seccompProfile is not explicitly configured.

As per Kubernetes and CIS benchmarks, containers should enforce:

securityContext:
  seccompProfile:
    type: RuntimeDefault

---

Expected Behavior

All containers should explicitly define a seccomp profile:

• Preferably RuntimeDefault (recommended)
• Avoid Unconfined

---

Current Behavior

• securityContext is present
• seccompProfile is missing
• This results in a compliance violation and increases attack surface

---

Impact

• Fails CIS Kubernetes Benchmark controls
• Potential exposure to syscalls not restricted by default seccomp
• Flagged as critical vulnerability in Prisma Cloud

---

Proposed Fix

Update the deployment YAML to include:

securityContext:
  seccompProfile:
    type: RuntimeDefault

---

Questions / Considerations

• Will enforcing RuntimeDefault have any impact on application behavior?