SYS_ADMIN capability added to a Kubernetes container

Description

SYS_ADMIN is a powerful Linux capability covering broad administrative operations, including mounts. Adding it to an application can violate least privilege and increase the effects of a container compromise. Its effective scope also depends on user namespaces and other security controls.

Potential impact

Unneeded system administration functions can be abused inside the container.
Combined with other host access or vulnerabilities, these permissions may affect the node and other workloads.

Remediation

Remove unnecessary SYS_ADMIN entries from security_context.capabilities.add.
Where possible, drop all default capabilities and add back only the narrow permissions actually required.
Restrict privileged mode, hostPath and shared host namespaces too. Setting only allow_privilege_escalation = false while retaining SYS_ADMIN does not resolve this risk.

Examples

The examples compare capability additions. The image version is historical; use a supported image for actual deployment.

Before

hcl

resource "kubernetes_pod" "app_pod" {
  metadata {
    name = "terraform-example"
  }

  spec {
    container {
      image = "nginx:1.7.9"
      name  = "app-container"

      security_context {
        capabilities {
          add = ["SYS_ADMIN"]
        }
      }
    }
  }
}

Adding SYS_ADMIN grants broad administrative permissions.

After

hcl

resource "kubernetes_pod" "app_pod" {
  metadata {
    name = "terraform-example"
  }

  spec {
    container {
      image = "nginx:1.7.9"
      name  = "app-container"
    }
  }
}

The SYS_ADMIN addition is removed. This does not remove every runtime default capability; verify that the remaining permissions are necessary.