<p>I'm using Google Cloud Build to CI/CD my application, which rely on multiple cronjobs. The first step of my build is like:</p>
<pre class="lang-yaml prettyprint-override"><code>  # validate k8s manifests
  - id: validate-k8s
    name: quay.io/fairwinds/polaris:1.2.1
    entrypoint: polaris
    args:
      - audit
      - --audit-path
      - ./devops/k8s/cronjobs/worker-foo.yaml
      - --set-exit-code-on-danger
      - --set-exit-code-below-score
      - &quot;87&quot;
</code></pre>
<p>I'm using <a href="https://polaris.docs.fairwinds.com/checks/security/" rel="nofollow noreferrer">Polaris</a> to enforce best security practices. For each cronjob, I have a deployment manifest that is like:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: worker-foo
  namespace: foo
spec:
  schedule: &quot;30 1-5,20-23 * * *&quot;
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      backoffLimit: 3
      template:
        spec:
          hostIPC: false
          hostPID: false
          hostNetwork: false
          volumes:
            - name: foo-sa
              secret:
                secretName: foo-sa
            - name: foo-secrets
              secret:
                secretName: foo-secrets
            - name: tmp-pod
              emptyDir: {}
          restartPolicy: OnFailure
          containers:
          - name: worker-foo
            image: gcr.io/bar/foo:latest
            imagePullPolicy: &quot;Always&quot;
            resources:
              requests:
                memory: &quot;512M&quot;
                cpu: &quot;50m&quot;
              limits:
                memory: &quot;6000M&quot;
                cpu: &quot;500m&quot;
            volumeMounts:
            - name: foo-sa
              mountPath: /var/secrets/foo-sa
            - mountPath: /tmp/pod
              name: tmp-pod
            command: [&quot;/bin/bash&quot;, &quot;-c&quot;]
            args:
              - |
                timeout --kill-after=10500 10500 python foo/foo/foo.py --prod;

</code></pre>
<p>I found <a href="https://blog.aquasec.com/kubernetess-policy" rel="nofollow noreferrer">here</a> that the hierarchy of HostIPC parameter in manifest file is “spec.jobTemplate.spec.template.spec.HostIPC”, but it does not seem to conform Polaris validation:</p>
<pre><code>Step #0 - &quot;validate-k8s&quot;:   &quot;Results&quot;: [
Step #0 - &quot;validate-k8s&quot;:     {
Step #0 - &quot;validate-k8s&quot;:       &quot;Name&quot;: &quot;worker-foo&quot;,
Step #0 - &quot;validate-k8s&quot;:       &quot;Namespace&quot;: &quot;foo&quot;,
Step #0 - &quot;validate-k8s&quot;:       &quot;Kind&quot;: &quot;CronJob&quot;,
Step #0 - &quot;validate-k8s&quot;:       &quot;Results&quot;: {},
Step #0 - &quot;validate-k8s&quot;:       &quot;PodResult&quot;: {
Step #0 - &quot;validate-k8s&quot;:         &quot;Name&quot;: &quot;&quot;,
Step #0 - &quot;validate-k8s&quot;:         &quot;Results&quot;: {
Step #0 - &quot;validate-k8s&quot;:           &quot;hostIPCSet&quot;: {
Step #0 - &quot;validate-k8s&quot;:             &quot;ID&quot;: &quot;hostIPCSet&quot;,
Step #0 - &quot;validate-k8s&quot;:             &quot;Message&quot;: &quot;Host IPC is not configured&quot;,
Step #0 - &quot;validate-k8s&quot;:             &quot;Success&quot;: true,
Step #0 - &quot;validate-k8s&quot;:             &quot;Severity&quot;: &quot;danger&quot;,
Step #0 - &quot;validate-k8s&quot;:             &quot;Category&quot;: &quot;Security&quot;
Step #0 - &quot;validate-k8s&quot;:           },
Step #0 - &quot;validate-k8s&quot;:           &quot;hostNetworkSet&quot;: {
Step #0 - &quot;validate-k8s&quot;:             &quot;ID&quot;: &quot;hostNetworkSet&quot;,
Step #0 - &quot;validate-k8s&quot;:             &quot;Message&quot;: &quot;Host network is not configured&quot;,
Step #0 - &quot;validate-k8s&quot;:             &quot;Success&quot;: true,
Step #0 - &quot;validate-k8s&quot;:             &quot;Severity&quot;: &quot;warning&quot;,
Step #0 - &quot;validate-k8s&quot;:             &quot;Category&quot;: &quot;Networking&quot;
Step #0 - &quot;validate-k8s&quot;:           },
Step #0 - &quot;validate-k8s&quot;:           &quot;hostPIDSet&quot;: {
Step #0 - &quot;validate-k8s&quot;:             &quot;ID&quot;: &quot;hostPIDSet&quot;,
Step #0 - &quot;validate-k8s&quot;:             &quot;Message&quot;: &quot;Host PID is not configured&quot;,
Step #0 - &quot;validate-k8s&quot;:             &quot;Success&quot;: true,
Step #0 - &quot;validate-k8s&quot;:             &quot;Severity&quot;: &quot;danger&quot;,
Step #0 - &quot;validate-k8s&quot;:             &quot;Category&quot;: &quot;Security&quot;
Step #0 - &quot;validate-k8s&quot;:           }
Step #0 - &quot;validate-k8s&quot;:         },
</code></pre>
<p>What I'm missing here? How should I declare HostIPC and HostPID params in order to satisfy Polaris validation?</p>
<p>Possibly related issue: <a href="https://github.com/FairwindsOps/polaris/issues/328" rel="nofollow noreferrer">https://github.com/FairwindsOps/polaris/issues/328</a></p>

<p>Polaris may be asking you to explicitly set those attributes to false. Try this:</p>
<pre><code>...
jobTemplate:
  spec:
    backoffLimit: 3
    template:
      spec:
        hostIPC: false
        hostNetwork: false
        hostPID: false
        ...
        containers:
        - worker-foo
          ...
 ...
</code></pre>
