@@ -65,6 +65,35 @@ def test_all_containers_have_hardened_security_context(kube_version):
6565 )
6666
6767
68+ # mountPropagation isn't a securityContext field, so it's not part of hardening_problems() above,
69+ # and Pod Security Admission doesn't validate it either -- this is a Kyverno/OPA-style customer
70+ # policy control instead, forbidding the two unsafe values (PINF-986: MountPropagation).
71+ UNSAFE_MOUNT_PROPAGATION = {"HostToContainer" , "Bidirectional" }
72+
73+
74+ @pytest .mark .parametrize ("kube_version" , supported_k8s_versions )
75+ def test_no_containers_use_unsafe_mount_propagation (kube_version ):
76+ """Render the whole chart and assert no volumeMount sets an unsafe mountPropagation."""
77+ docs = render_chart (kube_version = kube_version , values = get_all_features ())
78+
79+ offenders = {}
80+ checked = 0
81+ for doc in docs :
82+ if doc .get ("metadata" , {}).get ("name" ) in EXCLUDED_DOCS :
83+ continue
84+ owner = f"{ doc ['kind' ]} { doc ['metadata' ]['name' ]}
85+ for name , container in get_containers_by_name (doc , include_init_containers = True ).items ():
86+ checked += 1
87+ for mount in container .get ("volumeMounts" ) or []:
88+ if mount .get ("mountPropagation" ) in UNSAFE_MOUNT_PROPAGATION :
89+ offenders [f"{ owner } { name } { mount ['name' ]} ] = mount ["mountPropagation" ]
90+
91+ assert checked , "No containers were rendered; cannot validate mountPropagation"
92+ assert not offenders , "volumeMounts with an unsafe mountPropagation (mount: value):\n " + "\n " .join (
93+ f" { key } { value } for key , value in sorted (offenders .items ())
94+ )
95+
96+
6897# --- git-sync-relay PSS-Restricted conformance (PINF-585 follow-up) -----------------
6998#
7099# git-sync-relay is not processed by houston's securityHardeningConfig, so unlike
0 commit comments