Pod security context

The Cloud Pak for Business Automation pods are secured in a Red Hat® OpenShift® cluster with Kubernetes parameters that define a security context. A security context defines privilege and access control settings.

Cloud Pak for Business Automation containers are immutable, which means that a container image cannot be modified in any way. The restriction applies to all the Cloud Pak images, and its dependencies. The images are licensed property of IBM® and cannot be updated or adapted, which includes copying an image as a base image to build a child image. Third-party applications such as APM from AppDynamics, Dynatrace, and Instana® cannot be used to inject agents into CP4BA runtime containers to update or modify them.

The security context definition for Cloud Pak for Business Automation pods has the following immutable parameters:

securityContext:
  capabilities:
    drop:
      - ALL
  privileged: false
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  runAsNonRoot: true

Note: The immutable parameters are set inside the Cloud Pak for Business Automation Pod definitions, which cannot be tuned.

Table 1. Security context parameters
Parameters	Description
`capabilities: drop: - ALL`	The `drop: - ALL` parameter is a security measure to minimize the potential attack surface by reducing the privileges that the container has. It follows the principle of least privilege, also known as the principle of minimal privilege. The approach reduces the risk of privilege escalation and other security vulnerabilities that attackers can use.
`privileged: false`	The `privileged: false` parameter prevents the container from accessing the host's devices and reduces the administrative actions that normally require root privileges. The restriction avoids compromising the host or misuse of the host’s resources.
`readOnlyRootFilesystem: true`	The `readOnlyRootFilesystem: true` parameter sets the root file system to immutable. It reduces the attack surface of the containers as an attacker cannot manipulate the executable files of the container.
`allowPrivilegeEscalation: false`	The `allowPrivilegeEscalation: false` parameter prevents the process from gaining privileges, even if the process has the potential to do so. It includes situations where the process might try to execute a binary or use other mechanisms to elevate its privileges.
`runAsNonRoot: true`	The `runAsNonRoot: true` parameter forces the container to run as a non-root user. If the image specified in the container configuration attempts to run as the root user (UID 0), the container fails to start. It makes sure that no process within the container has root privileges.

The spec definition for Cloud Pak for Business Automation pods has the following immutable security-related parameters.

spec:
  automountServiceAccountToken: false

Table 2. Pod security parameters
Parameters	Description
`automountServiceAccountToken: false`	The `automountServiceAccountToken:false` parameter enhances security by reducing the risk of service account token leakage, minimizing the attack surface, and adhering to the principle of least privilege. This practice limits unauthorized access and potential privilege escalation if a pod is compromised. It also helps to meet regulatory compliance requirements by verifying explicit permissions and pod access to the Kubernetes API. It improves overall pod security and isolation from the cluster’s control plane.