# Snyk test report

March 24th 2024, 12:23:30 am (UTC+00:00)

Scanned the following path:

- /argo-cd/manifests/namespace-install.yaml (Kubernetes)

39 total issues

Project | manifests/namespace-install.yaml
Path | /argo-cd/manifests/namespace-install.yaml
Project Type | Kubernetes

## Role or ClusterRole with dangerous permissions

medium severity

- Public ID: SNYK-CC-K8S-47
- Introduced through: [DocId: 7] › rules[0] › resources
- Line number: 77

## Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

## Remediation

Consider removing these permissions

More about this issue

## Role or ClusterRole with dangerous permissions

medium severity

- Public ID: SNYK-CC-K8S-47
- Introduced through: [DocId: 8] › rules[4] › resources
- Line number: 154

## Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

## Remediation

Consider removing these permissions

More about this issue

## Role or ClusterRole with dangerous permissions

medium severity

- Public ID: SNYK-CC-K8S-47
- Introduced through: [DocId: 9] › rules[0] › resources
- Line number: 182

## Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

## Remediation

Consider removing these permissions

More about this issue

## Role or ClusterRole with dangerous permissions

medium severity

- Public ID: SNYK-CC-K8S-47
- Introduced through: [DocId: 10] › rules[1] › resources
- Line number: 212

## Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

## Remediation

Consider removing these permissions

More about this issue

## Role or ClusterRole with dangerous permissions

medium severity

- Public ID: SNYK-CC-K8S-47
- Introduced through: [DocId: 10] › rules[3] › resources
- Line number: 230

## Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

## Remediation

Consider removing these permissions

More about this issue

## Role or ClusterRole with dangerous permissions

medium severity

- Public ID: SNYK-CC-K8S-47
- Introduced through: [DocId: 11] › rules[0] › resources
- Line number: 246

## Impact

Using this role grants dangerous permissions. For a ClusterRole this would be considered high severity.

## Remediation

Consider removing these permissions

More about this issue

## Container could be running with outdated image

low severity

- Public ID: SNYK-CC-K8S-42
- Introduced through: [DocId: 39] › spec › template › spec › initContainers[copyutil] › imagePullPolicy
- Line number: 1197

## Impact

The container may run with outdated or unauthorized image

## Remediation

Set `imagePullPolicy` attribute to `Always`

More about this issue

## Container has no CPU limit

low severity

- Public ID: SNYK-CC-K8S-5
- Introduced through: [DocId: 35] › input › spec › template › spec › containers[argocd-applicationset-controller] › resources › limits › cpu
- Line number: 640

## Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

## Remediation

Add `resources.limits.cpu` field with required CPU limit value

More about this issue

## Container has no CPU limit

low severity

- Public ID: SNYK-CC-K8S-5
- Introduced through: [DocId: 36] › input › spec › template › spec › initContainers[copyutil] › resources › limits › cpu
- Line number: 812

## Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

## Remediation

Add `resources.limits.cpu` field with required CPU limit value

More about this issue

## Container has no CPU limit

low severity

- Public ID: SNYK-CC-K8S-5
- Introduced through: [DocId: 36] › input › spec › template › spec › containers[dex] › resources › limits › cpu
- Line number: 778

## Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

## Remediation

Add `resources.limits.cpu` field with required CPU limit value

More about this issue

## Container has no CPU limit

low severity

- Public ID: SNYK-CC-K8S-5
- Introduced through: [DocId: 37] › input › spec › template › spec › containers[argocd-notifications-controller] › resources › limits › cpu
- Line number: 872

## Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

## Remediation

Add `resources.limits.cpu` field with required CPU limit value

More about this issue

## Container has no CPU limit

low severity

- Public ID: SNYK-CC-K8S-5
- Introduced through: [DocId: 38] › input › spec › template › spec › containers[redis] › resources › limits › cpu
- Line number: 953

## Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

## Remediation

Add `resources.limits.cpu` field with required CPU limit value

More about this issue

## Container has no CPU limit

low severity

- Public ID: SNYK-CC-K8S-5
- Introduced through: [DocId: 39] › input › spec › template › spec › initContainers[copyutil] › resources › limits › cpu
- Line number: 1197

## Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

## Remediation

Add `resources.limits.cpu` field with required CPU limit value

More about this issue

## Container has no CPU limit

low severity

- Public ID: SNYK-CC-K8S-5
- Introduced through: [DocId: 39] › input › spec › template › spec › containers[argocd-repo-server] › resources › limits › cpu
- Line number: 1009

## Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

## Remediation

Add `resources.limits.cpu` field with required CPU limit value

More about this issue

## Container has no CPU limit

low severity

- Public ID: SNYK-CC-K8S-5
- Introduced through: [DocId: 40] › input › spec › template › spec › containers[argocd-server] › resources › limits › cpu
- Line number: 1282

## Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

## Remediation

Add `resources.limits.cpu` field with required CPU limit value

More about this issue

## Container has no CPU limit

low severity

- Public ID: SNYK-CC-K8S-5
- Introduced through: [DocId: 41] › input › spec › template › spec › containers[argocd-application-controller] › resources › limits › cpu
- Line number: 1592

## Impact

CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.

## Remediation

Add `resources.limits.cpu` field with required CPU limit value

More about this issue

## Container is running with multiple open ports

low severity

- Public ID: SNYK-CC-K8S-36
- Introduced through: [DocId: 36] › spec › template › spec › containers[dex] › ports
- Line number: 792

## Impact

Increases the attack surface of the application and the container.

## Remediation

Reduce `ports` count to 2

More about this issue

## Container is running with writable root filesystem

low severity

- Public ID: SNYK-CC-K8S-8
- Introduced through: [DocId: 38] › spec › template › spec › containers[redis] › securityContext › readOnlyRootFilesystem
- Line number: 963

## Impact

Compromised process could abuse writable root filesystem to elevate privileges

## Remediation

Set `spec.{containers, initContainers}.securityContext.readOnlyRootFilesystem` to `true`

More about this issue

## Container is running without liveness probe

low severity

- Public ID: SNYK-CC-K8S-41
- Introduced through: [DocId: 35] › spec › template › spec › containers[argocd-applicationset-controller] › livenessProbe
- Line number: 640

## Impact

Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

## Remediation

Add `livenessProbe` attribute

More about this issue

## Container is running without liveness probe

low severity

- Public ID: SNYK-CC-K8S-41
- Introduced through: [DocId: 36] › spec › template › spec › containers[dex] › livenessProbe
- Line number: 778

## Impact

Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

## Remediation

Add `livenessProbe` attribute

More about this issue

## Container is running without liveness probe

low severity

- Public ID: SNYK-CC-K8S-41
- Introduced through: [DocId: 38] › spec › template › spec › containers[redis] › livenessProbe
- Line number: 953

## Impact

Kubernetes will not be able to detect if application is able to service requests, and will not restart unhealthy pods

## Remediation

Add `livenessProbe` attribute

More about this issue

## Container is running without memory limit

low severity

- Public ID: SNYK-CC-K8S-4
- Introduced through: [DocId: 35] › input › spec › template › spec › containers[argocd-applicationset-controller] › resources › limits › memory
- Line number: 640

## Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

## Remediation

Set `resources.limits.memory` value

More about this issue

## Container is running without memory limit

low severity

- Public ID: SNYK-CC-K8S-4
- Introduced through: [DocId: 36] › input › spec › template › spec › containers[dex] › resources › limits › memory
- Line number: 778

## Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

## Remediation

Set `resources.limits.memory` value

More about this issue

## Container is running without memory limit

low severity

- Public ID: SNYK-CC-K8S-4
- Introduced through: [DocId: 36] › input › spec › template › spec › initContainers[copyutil] › resources › limits › memory
- Line number: 812

## Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

## Remediation

Set `resources.limits.memory` value

More about this issue

## Container is running without memory limit

low severity

- Public ID: SNYK-CC-K8S-4
- Introduced through: [DocId: 37] › input › spec › template › spec › containers[argocd-notifications-controller] › resources › limits › memory
- Line number: 872

## Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

## Remediation

Set `resources.limits.memory` value

More about this issue

## Container is running without memory limit

low severity

- Public ID: SNYK-CC-K8S-4
- Introduced through: [DocId: 38] › input › spec › template › spec › containers[redis] › resources › limits › memory
- Line number: 953

## Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

## Remediation

Set `resources.limits.memory` value

More about this issue

## Container is running without memory limit

low severity

- Public ID: SNYK-CC-K8S-4
- Introduced through: [DocId: 39] › input › spec › template › spec › initContainers[copyutil] › resources › limits › memory
- Line number: 1197

## Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

## Remediation

Set `resources.limits.memory` value

More about this issue

## Container is running without memory limit

low severity

- Public ID: SNYK-CC-K8S-4
- Introduced through: [DocId: 39] › input › spec › template › spec › containers[argocd-repo-server] › resources › limits › memory
- Line number: 1009

## Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

## Remediation

Set `resources.limits.memory` value

More about this issue

## Container is running without memory limit

low severity

- Public ID: SNYK-CC-K8S-4
- Introduced through: [DocId: 40] › input › spec › template › spec › containers[argocd-server] › resources › limits › memory
- Line number: 1282

## Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

## Remediation

Set `resources.limits.memory` value

More about this issue

## Container is running without memory limit

low severity

- Public ID: SNYK-CC-K8S-4
- Introduced through: [DocId: 41] › input › spec › template › spec › containers[argocd-application-controller] › resources › limits › memory
- Line number: 1592

## Impact

Containers without memory limits are more likely to be terminated when the node runs out of memory

## Remediation

Set `resources.limits.memory` value

More about this issue

## Container's or Pod's UID could clash with host's UID

low severity

- Public ID: SNYK-CC-K8S-11
- Introduced through: [DocId: 35] › input › spec › template › spec › containers[argocd-applicationset-controller] › securityContext › runAsUser
- Line number: 715

## Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

## Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

More about this issue

## Container's or Pod's UID could clash with host's UID

low severity

- Public ID: SNYK-CC-K8S-11
- Introduced through: [DocId: 36] › input › spec › template › spec › initContainers[copyutil] › securityContext › runAsUser
- Line number: 820

## Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

## Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

More about this issue

## Container's or Pod's UID could clash with host's UID

low severity

- Public ID: SNYK-CC-K8S-11
- Introduced through: [DocId: 36] › input › spec › template › spec › containers[dex] › securityContext › runAsUser
- Line number: 795

## Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

## Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

More about this issue

## Container's or Pod's UID could clash with host's UID

low severity

- Public ID: SNYK-CC-K8S-11
- Introduced through: [DocId: 37] › input › spec › template › spec › containers[argocd-notifications-controller] › securityContext › runAsUser
- Line number: 887

## Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

## Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

More about this issue

## Container's or Pod's UID could clash with host's UID

low severity

- Public ID: SNYK-CC-K8S-11
- Introduced through: [DocId: 38] › input › spec › template › spec › containers[redis] › securityContext › runAsUser
- Line number: 963

## Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

## Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

More about this issue

## Container's or Pod's UID could clash with host's UID

low severity

- Public ID: SNYK-CC-K8S-11
- Introduced through: [DocId: 39] › input › spec › template › spec › initContainers[copyutil] › securityContext › runAsUser
- Line number: 1204

## Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

## Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

More about this issue

## Container's or Pod's UID could clash with host's UID

low severity

- Public ID: SNYK-CC-K8S-11
- Introduced through: [DocId: 39] › input › spec › template › spec › containers[argocd-repo-server] › securityContext › runAsUser
- Line number: 1170

## Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

## Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

More about this issue

## Container's or Pod's UID could clash with host's UID

low severity

- Public ID: SNYK-CC-K8S-11
- Introduced through: [DocId: 40] › input › spec › template › spec › containers[argocd-server] › securityContext › runAsUser
- Line number: 1502

## Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

## Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

More about this issue

## Container's or Pod's UID could clash with host's UID

low severity

- Public ID: SNYK-CC-K8S-11
- Introduced through: [DocId: 41] › input › spec › template › spec › containers[argocd-application-controller] › securityContext › runAsUser
- Line number: 1734

## Impact

UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass

## Remediation

Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence

More about this issue