Query: Pod Security Policy should force containers to run with read-only root file system

Description

Pod Security Policy `readOnlyRootFilesystem` controls whether the Pod containers run with read-only root file system. Containers in a Pod should always run with a read only root file system. Using an immutable root filesystem and a verified boot mechanism prevents against attackers from owning the machine through permanent local changes. An immutable root filesystem can also prevent malicious binaries from writing to the host system.

Query

Tables used in this query:

• kubernetes_pod_security_policy

Controls using this query:

• Pod Security Policy should force containers to run with read-only root file system

SQL