Snyk - Open Source Security

Snyk test report

June 16th 2024, 12:22:32 am (UTC+00:00)

Scanned the following path:
  • /argo-cd/manifests/install.yaml (Kubernetes)
44 total issues
Project manifests/install.yaml
Path /argo-cd/manifests/install.yaml
Project Type Kubernetes

Role or ClusterRole with dangerous permissions

high severity

  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 17] rules[5] resources
  • Line number: 20895

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


Role or ClusterRole with dangerous permissions

medium severity

  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 10] rules[0] resources
  • Line number: 20580

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


Role or ClusterRole with dangerous permissions

medium severity

  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 11] rules[4] resources
  • Line number: 20665

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


Role or ClusterRole with dangerous permissions

medium severity

  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 12] rules[0] resources
  • Line number: 20693

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


Role or ClusterRole with dangerous permissions

medium severity

  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 13] rules[1] resources
  • Line number: 20723

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


Role or ClusterRole with dangerous permissions

medium severity

  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 13] rules[3] resources
  • Line number: 20741

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


Role or ClusterRole with dangerous permissions

medium severity

  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 14] rules[0] resources
  • Line number: 20759

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


Role or ClusterRole with dangerous permissions

medium severity

  • Public ID: SNYK-CC-K8S-47
  • Introduced through: [DocId: 15] rules[0] resources
  • Line number: 20781

Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

Remediation

Consider removing these permissions


Container could be running with outdated image

low severity

  • Public ID: SNYK-CC-K8S-42
  • Introduced through: [DocId: 48] spec template spec initContainers[secret-init] imagePullPolicy
  • Line number: 21827

Impact

The container may run with outdated or unauthorized image

Remediation

Set `imagePullPolicy` attribute to `Always`


Container could be running with outdated image

low severity

  • Public ID: SNYK-CC-K8S-42
  • Introduced through: [DocId: 49] spec template spec initContainers[copyutil] imagePullPolicy
  • Line number: 22108

Impact

The container may run with outdated or unauthorized image

Remediation

Set `imagePullPolicy` attribute to `Always`


Container has no CPU limit

low severity

  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 45] input spec template spec containers[argocd-applicationset-controller] resources limits cpu
  • Line number: 21388

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add `resources.limits.cpu` field with required CPU limit value


Container has no CPU limit

low severity

  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 46] input spec template spec initContainers[copyutil] resources limits cpu
  • Line number: 21639

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add `resources.limits.cpu` field with required CPU limit value


Container has no CPU limit

low severity

  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 46] input spec template spec containers[dex] resources limits cpu
  • Line number: 21605

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add `resources.limits.cpu` field with required CPU limit value


Container has no CPU limit

low severity

  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 47] input spec template spec containers[argocd-notifications-controller] resources limits cpu
  • Line number: 21699

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add `resources.limits.cpu` field with required CPU limit value


Container has no CPU limit

low severity

  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 48] input spec template spec containers[redis] resources limits cpu
  • Line number: 21798

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add `resources.limits.cpu` field with required CPU limit value


Container has no CPU limit

low severity

  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 48] input spec template spec initContainers[secret-init] resources limits cpu
  • Line number: 21822

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add `resources.limits.cpu` field with required CPU limit value


Container has no CPU limit

low severity

  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 49] input spec template spec initContainers[copyutil] resources limits cpu
  • Line number: 22108

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add `resources.limits.cpu` field with required CPU limit value


Container has no CPU limit

low severity

  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 49] input spec template spec containers[argocd-repo-server] resources limits cpu
  • Line number: 21879

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add `resources.limits.cpu` field with required CPU limit value


Container has no CPU limit

low severity

  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 50] input spec template spec containers[argocd-server] resources limits cpu
  • Line number: 22193

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add `resources.limits.cpu` field with required CPU limit value


Container has no CPU limit

low severity

  • Public ID: SNYK-CC-K8S-5
  • Introduced through: [DocId: 51] input spec template spec containers[argocd-application-controller] resources limits cpu
  • Line number: 22544

Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

Remediation

Add `resources.limits.cpu` field with required CPU limit value


Container is running with multiple open ports

low severity

  • Public ID: SNYK-CC-K8S-36
  • Introduced through: [DocId: 46] spec template spec containers[dex] ports
  • Line number: 21619

Impact

Increases the attack surface of the application and the container.

Remediation

Reduce `ports` count to 2


Container is running without liveness probe

low severity

  • Public ID: SNYK-CC-K8S-41
  • Introduced through: [DocId: 45] spec template spec containers[argocd-applicationset-controller] livenessProbe
  • Line number: 21388

Impact

Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

Remediation

Add `livenessProbe` attribute


Container is running without liveness probe

low severity

  • Public ID: SNYK-CC-K8S-41
  • Introduced through: [DocId: 46] spec template spec containers[dex] livenessProbe
  • Line number: 21605

Impact

Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

Remediation

Add `livenessProbe` attribute


Container is running without liveness probe

low severity

  • Public ID: SNYK-CC-K8S-41
  • Introduced through: [DocId: 48] spec template spec containers[redis] livenessProbe
  • Line number: 21798

Impact

Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

Remediation

Add `livenessProbe` attribute


Container is running without memory limit

low severity

  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 45] input spec template spec containers[argocd-applicationset-controller] resources limits memory
  • Line number: 21388

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set `resources.limits.memory` value


Container is running without memory limit

low severity

  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 46] input spec template spec containers[dex] resources limits memory
  • Line number: 21605

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set `resources.limits.memory` value


Container is running without memory limit

low severity

  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 46] input spec template spec initContainers[copyutil] resources limits memory
  • Line number: 21639

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set `resources.limits.memory` value


Container is running without memory limit

low severity

  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 47] input spec template spec containers[argocd-notifications-controller] resources limits memory
  • Line number: 21699

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set `resources.limits.memory` value


Container is running without memory limit

low severity

  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 48] input spec template spec containers[redis] resources limits memory
  • Line number: 21798

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set `resources.limits.memory` value


Container is running without memory limit

low severity

  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 48] input spec template spec initContainers[secret-init] resources limits memory
  • Line number: 21822

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set `resources.limits.memory` value


Container is running without memory limit

low severity

  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 49] input spec template spec initContainers[copyutil] resources limits memory
  • Line number: 22108

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set `resources.limits.memory` value


Container is running without memory limit

low severity

  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 49] input spec template spec containers[argocd-repo-server] resources limits memory
  • Line number: 21879

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set `resources.limits.memory` value


Container is running without memory limit

low severity

  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 50] input spec template spec containers[argocd-server] resources limits memory
  • Line number: 22193

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set `resources.limits.memory` value


Container is running without memory limit

low severity

  • Public ID: SNYK-CC-K8S-4
  • Introduced through: [DocId: 51] input spec template spec containers[argocd-application-controller] resources limits memory
  • Line number: 22544

Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

Remediation

Set `resources.limits.memory` value


Container's or Pod's UID could clash with host's UID

low severity

  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 45] input spec template spec containers[argocd-applicationset-controller] securityContext runAsUser
  • Line number: 21529

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence


Container's or Pod's UID could clash with host's UID

low severity

  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 46] input spec template spec initContainers[copyutil] securityContext runAsUser
  • Line number: 21647

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence


Container's or Pod's UID could clash with host's UID

low severity

  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 46] input spec template spec containers[dex] securityContext runAsUser
  • Line number: 21622

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence


Container's or Pod's UID could clash with host's UID

low severity

  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 47] input spec template spec containers[argocd-notifications-controller] securityContext runAsUser
  • Line number: 21732

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence


Container's or Pod's UID could clash with host's UID

low severity

  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 48] input spec template spec containers[redis] securityContext runAsUser
  • Line number: 21815

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence


Container's or Pod's UID could clash with host's UID

low severity

  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 48] input spec template spec initContainers[secret-init] securityContext runAsUser
  • Line number: 21829

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence


Container's or Pod's UID could clash with host's UID

low severity

  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 49] input spec template spec initContainers[copyutil] securityContext runAsUser
  • Line number: 22115

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence


Container's or Pod's UID could clash with host's UID

low severity

  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 49] input spec template spec containers[argocd-repo-server] securityContext runAsUser
  • Line number: 22081

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence


Container's or Pod's UID could clash with host's UID

low severity

  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 50] input spec template spec containers[argocd-server] securityContext runAsUser
  • Line number: 22454

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence


Container's or Pod's UID could clash with host's UID

low severity

  • Public ID: SNYK-CC-K8S-11
  • Introduced through: [DocId: 51] input spec template spec containers[argocd-application-controller] securityContext runAsUser
  • Line number: 22745

Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence