UNCLASSIFIED - NO CUI

K8sPSPSeccomp Constraint Uses Deprecated Annotation

K8sPSPSeccomp constraint checks that seccomp.security.alpha.kubernetes.io/pod and container.seccomp.security.alpha.kubernetes.io/[name] are set. However, this feature was removed in Kubernetes 1.25 in favor of the native setting spec.securityContext.seccompProfile.type. This effectively makes this constraint useless, as violations may actually have a matching profile set.

This constraint should be updated to check spec.securityContext.seccompProfile.type instead.

Edited by Noah Gearhart