grpc task file system vulnerability

[Alan-Cha]

The grpc task fetches the protobuf + other assorted files and saves them in the pod file system (see here).

Writing to the file system is considered a vulnerability according to kube-linter.

The grpc task needs to be rewritten to store the fetched files in a different manner and readOnlyRootFilesystem needs to be set to true for both job and cronjob templates.

---

kube-linter error message:

iter8.yaml: (object: <no namespace>/release-name-1-job batch/v1, Kind=Job) container "iter8" does not have a read-only root file system (check: no-read-only-root-fs, remediation: Set readOnlyRootFilesystem to true in the container securityContext.)

iter8.yaml: (object: <no namespace>/release-name-1-job batch/v1, Kind=Job) container "iter8" is not set to runAsNonRoot (check: run-as-non-root, remediation: Set runAsUser to a non-zero number and runAsNonRoot to true in your pod or container securityContext. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details.)