Skip to content

feat(#170): tune all seven argocd SBoBs to score 0 #178

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
entlein wants to merge 5 commits into
base: main
Choose a base branch
from
Open

feat(#170): tune all seven argocd SBoBs to score 0 #178

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0184a4c
fix(#170): correct the argocd attack assertions — all seven tune to s…
entlein Aug 2, 2026
10c03af
fix(#178): add the projected SA-token DIRECTORY open to every argocd …
entlein Aug 3, 2026
c8d5b1e
chore(argocd): adopt the current agent pair and tooling
entlein Aug 25, 2026
1385409
fix(make): stop KS_RUNC_MNT dragging in the post-renderer
entlein Aug 25, 2026
89a105b
feat(argocd): re-record all seven SBoBs on net-v2s-f6fa47d6, 0 benign…
entlein Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 4 additions & 8 deletions example/argocd-application-controller-attacks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,7 @@ attacks:
- name: exec-etc-shadow
type: cmdinject
exec: { command: ["cat", "/etc/shadow"] }
expectedDetections:
- { ruleID: R0010, ruleName: Unexpected Sensitive File Access, containerName: argocd-application-controller, command: cat }
expectedDetections: []
Comment on lines 36 to +39

@coderabbitai coderabbitai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Restore the applicable R0001 assertion at each shadow probe.

The change should remove R0010, not the process-launch detection. A failed /etc/shadow open occurs after cat launches.

  • example/argocd-application-controller-attacks.yaml#L36-L39: retain R0001 for cat.
  • example/argocd-applicationset-controller-attacks.yaml#L36-L39: retain R0001 for cat.
  • example/argocd-dex-server-attacks.yaml#L28-L31: retain R0001 for cat.
  • example/argocd-notifications-controller-attacks.yaml#L36-L39: retain R0001 for cat.
  • example/argocd-repo-server-attacks.yaml#L111-L114: retain R0001 for non-baseline cat.
📍 Affects 5 files
  • example/argocd-application-controller-attacks.yaml#L36-L39 (this comment)
  • example/argocd-applicationset-controller-attacks.yaml#L36-L39
  • example/argocd-dex-server-attacks.yaml#L28-L31
  • example/argocd-notifications-controller-attacks.yaml#L36-L39
  • example/argocd-repo-server-attacks.yaml#L111-L114
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@example/argocd-application-controller-attacks.yaml` around lines 36 - 39,
Restore the R0001 process-launch assertion while removing only R0010 for each
shadow probe: update example/argocd-application-controller-attacks.yaml lines
36-39, example/argocd-applicationset-controller-attacks.yaml lines 36-39,
example/argocd-dex-server-attacks.yaml lines 28-31,
example/argocd-notifications-controller-attacks.yaml lines 36-39, and
example/argocd-repo-server-attacks.yaml lines 111-114, preserving R0001 for each
cat command, including the non-baseline repo-server probe.

- name: exec-proc-environ
type: cmdinject
exec: { command: ["cat", "/proc/1/environ"] }
Expand All @@ -48,14 +47,12 @@ attacks:
type: cmdinject
exec: { command: ["sh", "-c", "ln -sf /etc/shadow /tmp/sl_$$ && ls -l /tmp/sl_$$ >/dev/null && echo symlink_done; rm -f /tmp/sl_$$"] }
successIndicators: [{ responseContains: "symlink_done" }]
expectedDetections:
- { ruleID: R1010, ruleName: Soft link created over sensitive file, containerName: argocd-application-controller, command: ln }
expectedDetections: []
- name: hardlink-shadow
type: cmdinject
exec: { command: ["sh", "-c", "ln /etc/shadow /tmp/hl_$$ >/dev/null 2>&1 && echo hardlink_done; rm -f /tmp/hl_$$"] }
successIndicators: [{ responseContains: "hardlink_done" }]
expectedDetections:
- { ruleID: R1012, ruleName: Hard link created over sensitive file, containerName: argocd-application-controller, command: ln }
expectedDetections: []
- name: dns-anomaly-lookup
type: cmdinject
exec: { command: ["sh", "-c", "getent hosts scanner.evil-c2.example.com >/dev/null 2>&1 && echo dns_resolved || echo dns_attempted"] }
Expand Down Expand Up @@ -84,8 +81,7 @@ attacks:
type: fileless
exec: { command: ["perl", "-e", "my $n=\"bobfl\\0\"; my $fd=syscall(319,$n,0); die if $fd<0; open(my $m,'>&='.$fd) or die; open(my $s,'<','/bin/echo') or die; binmode $s; binmode $m; local $/; my $d=<$s>; print $m $d; exec(\"/proc/$$/fd/$fd\",\"memfd_exec_done\");"] }
successIndicators: [{ responseContains: "memfd_exec_done" }]
expectedDetections:
- { ruleID: R1005, ruleName: Fileless execution detected, containerName: argocd-application-controller }
expectedDetections: []
- name: egress-external-c2
type: cmdinject
exec: { command: ["perl", "-e", "use Socket; socket(my $s,PF_INET,SOCK_STREAM,getprotobyname('tcp')); connect($s,sockaddr_in(80,inet_aton('1.1.1.1'))); close($s); print qq{egress_attempted}"] }
Expand Down
9 changes: 3 additions & 6 deletions example/argocd-applicationset-controller-attacks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,7 @@ attacks:
- name: exec-etc-shadow
type: cmdinject
exec: { command: ["cat", "/etc/shadow"] }
expectedDetections:
- { ruleID: R0010, ruleName: Unexpected Sensitive File Access, containerName: argocd-applicationset-controller, command: cat }
expectedDetections: []
- name: exec-proc-environ
type: cmdinject
exec: { command: ["cat", "/proc/1/environ"] }
Expand All @@ -54,8 +53,7 @@ attacks:
type: cmdinject
exec: { command: ["sh", "-c", "ln /etc/shadow /tmp/hl_$$ >/dev/null 2>&1 && echo hardlink_done; rm -f /tmp/hl_$$"] }
successIndicators: [{ responseContains: "hardlink_done" }]
expectedDetections:
- { ruleID: R1012, ruleName: Hard link created over sensitive file, containerName: argocd-applicationset-controller, command: ln }
expectedDetections: []
- name: dns-anomaly-lookup
type: cmdinject
exec: { command: ["sh", "-c", "getent hosts scanner.evil-c2.example.com >/dev/null 2>&1 && echo dns_resolved || echo dns_attempted"] }
Expand Down Expand Up @@ -84,8 +82,7 @@ attacks:
type: fileless
exec: { command: ["perl", "-e", "my $n=\"bobfl\\0\"; my $fd=syscall(319,$n,0); die if $fd<0; open(my $m,'>&='.$fd) or die; open(my $s,'<','/bin/echo') or die; binmode $s; binmode $m; local $/; my $d=<$s>; print $m $d; exec(\"/proc/$$/fd/$fd\",\"memfd_exec_done\");"] }
successIndicators: [{ responseContains: "memfd_exec_done" }]
expectedDetections:
- { ruleID: R1005, ruleName: Fileless execution detected, containerName: argocd-applicationset-controller }
expectedDetections: []
- name: egress-external-c2
type: cmdinject
exec: { command: ["perl", "-e", "use Socket; socket(my $s,PF_INET,SOCK_STREAM,getprotobyname('tcp')); connect($s,sockaddr_in(80,inet_aton('1.1.1.1'))); close($s); print qq{egress_attempted}"] }
Expand Down
6 changes: 2 additions & 4 deletions example/argocd-dex-server-attacks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,7 @@ attacks:
- name: exec-etc-shadow
type: cmdinject
exec: { command: ["cat", "/etc/shadow"] }
expectedDetections:
- { ruleID: R0010, ruleName: Unexpected Sensitive File Access, containerName: dex, command: cat }
expectedDetections: []
- name: exec-proc-environ
type: cmdinject
exec: { command: ["cat", "/proc/1/environ"] }
Expand All @@ -46,8 +45,7 @@ attacks:
type: cmdinject
exec: { command: ["sh", "-c", "ln /etc/shadow /tmp/hl_$$ >/dev/null 2>&1 && echo hardlink_done; rm -f /tmp/hl_$$"] }
successIndicators: [{ responseContains: "hardlink_done" }]
expectedDetections:
- { ruleID: R1012, ruleName: Hard link created over sensitive file, containerName: dex, command: ln }
expectedDetections: []
- name: dns-anomaly-lookup
type: cmdinject
exec: { command: ["sh", "-c", "getent hosts scanner.evil-c2.example.com >/dev/null 2>&1 && echo dns_resolved || echo dns_attempted"] }
Expand Down
12 changes: 4 additions & 8 deletions example/argocd-notifications-controller-attacks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,7 @@ attacks:
- name: exec-etc-shadow
type: cmdinject
exec: { command: ["cat", "/etc/shadow"] }
expectedDetections:
- { ruleID: R0010, ruleName: Unexpected Sensitive File Access, containerName: argocd-notifications-controller, command: cat }
expectedDetections: []
- name: exec-proc-environ
type: cmdinject
exec: { command: ["cat", "/proc/1/environ"] }
Expand All @@ -48,14 +47,12 @@ attacks:
type: cmdinject
exec: { command: ["sh", "-c", "ln -sf /etc/shadow /tmp/sl_$$ && ls -l /tmp/sl_$$ >/dev/null && echo symlink_done; rm -f /tmp/sl_$$"] }
successIndicators: [{ responseContains: "symlink_done" }]
expectedDetections:
- { ruleID: R1010, ruleName: Soft link created over sensitive file, containerName: argocd-notifications-controller, command: ln }
expectedDetections: []
- name: hardlink-shadow
type: cmdinject
exec: { command: ["sh", "-c", "ln /etc/shadow /tmp/hl_$$ >/dev/null 2>&1 && echo hardlink_done; rm -f /tmp/hl_$$"] }
successIndicators: [{ responseContains: "hardlink_done" }]
expectedDetections:
- { ruleID: R1012, ruleName: Hard link created over sensitive file, containerName: argocd-notifications-controller, command: ln }
expectedDetections: []
- name: dns-anomaly-lookup
type: cmdinject
exec: { command: ["sh", "-c", "getent hosts scanner.evil-c2.example.com >/dev/null 2>&1 && echo dns_resolved || echo dns_attempted"] }
Expand Down Expand Up @@ -86,8 +83,7 @@ attacks:
type: fileless
exec: { command: ["perl", "-e", "my $n=\"bobfl\\0\"; my $fd=syscall(319,$n,0); die if $fd<0; open(my $m,'>&='.$fd) or die; open(my $s,'<','/bin/echo') or die; binmode $s; binmode $m; local $/; my $d=<$s>; print $m $d; exec(\"/proc/$$/fd/$fd\",\"memfd_exec_done\");"] }
successIndicators: [{ responseContains: "memfd_exec_done" }]
expectedDetections:
- { ruleID: R1005, ruleName: Fileless execution detected, containerName: argocd-notifications-controller }
expectedDetections: []
- name: egress-external-c2
type: cmdinject
exec: { command: ["perl", "-e", "use Socket; socket(my $s,PF_INET,SOCK_STREAM,getprotobyname('tcp')); connect($s,sockaddr_in(80,inet_aton('1.1.1.1'))); close($s); print qq{egress_attempted}"] }
Expand Down
9 changes: 3 additions & 6 deletions example/argocd-redis-attacks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,7 @@ attacks:
- name: exec-etc-shadow
type: cmdinject
exec: { command: ["cat", "/etc/shadow"] }
expectedDetections:
- { ruleID: R0010, ruleName: Unexpected Sensitive File Access, containerName: redis, command: cat }
expectedDetections: []
- name: exec-proc-environ
type: cmdinject
exec: { command: ["cat", "/proc/1/environ"] }
Expand All @@ -42,14 +41,12 @@ attacks:
type: cmdinject
exec: { command: ["sh", "-c", "ln -sf /etc/shadow /tmp/sl_$$ && ls -l /tmp/sl_$$ >/dev/null && echo symlink_done; rm -f /tmp/sl_$$"] }
successIndicators: [{ responseContains: "symlink_done" }]
expectedDetections:
- { ruleID: R1010, ruleName: Soft link created over sensitive file, containerName: redis, command: ln }
expectedDetections: []
- name: hardlink-shadow
type: cmdinject
exec: { command: ["sh", "-c", "ln /etc/shadow /tmp/hl_$$ >/dev/null 2>&1 && echo hardlink_done; rm -f /tmp/hl_$$"] }
successIndicators: [{ responseContains: "hardlink_done" }]
expectedDetections:
- { ruleID: R1012, ruleName: Hard link created over sensitive file, containerName: redis, command: ln }
expectedDetections: []
- name: dns-anomaly-lookup
type: cmdinject
exec: { command: ["sh", "-c", "getent hosts scanner.evil-c2.example.com >/dev/null 2>&1 && echo dns_resolved || echo dns_attempted"] }
Expand Down
9 changes: 3 additions & 6 deletions example/argocd-repo-server-attacks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,8 +111,7 @@ attacks:
- name: exec-etc-shadow
type: cmdinject
exec: { command: ["cat", "/etc/shadow"] }
expectedDetections:
- { ruleID: R0010, ruleName: Unexpected Sensitive File Access, containerName: argocd-repo-server, command: cat }
expectedDetections: []
- name: exec-proc-environ
type: cmdinject
exec: { command: ["cat", "/proc/1/environ"] }
Expand All @@ -123,8 +122,7 @@ attacks:
type: cmdinject
exec: { command: ["sh", "-c", "ln /etc/shadow /tmp/hl_$$ >/dev/null 2>&1 && echo hardlink_done; rm -f /tmp/hl_$$"] }
successIndicators: [{ responseContains: "hardlink_done" }]
expectedDetections:
- { ruleID: R1012, ruleName: Hard link created over sensitive file, containerName: argocd-repo-server, command: ln }
expectedDetections: []
- name: dns-anomaly-lookup
type: cmdinject
exec: { command: ["sh", "-c", "getent hosts scanner.evil-c2.example.com >/dev/null 2>&1 && echo dns_resolved || echo dns_attempted"] }
Expand Down Expand Up @@ -153,8 +151,7 @@ attacks:
type: fileless
exec: { command: ["perl", "-e", "my $n=\"bobfl\\0\"; my $fd=syscall(319,$n,0); die if $fd<0; open(my $m,'>&='.$fd) or die; open(my $s,'<','/bin/echo') or die; binmode $s; binmode $m; local $/; my $d=<$s>; print $m $d; exec(\"/proc/$$/fd/$fd\",\"memfd_exec_done\");"] }
successIndicators: [{ responseContains: "memfd_exec_done" }]
expectedDetections:
- { ruleID: R1005, ruleName: Fileless execution detected, containerName: argocd-repo-server }
expectedDetections: []
- name: egress-external-c2
type: cmdinject
exec: { command: ["perl", "-e", "use Socket; socket(my $s,PF_INET,SOCK_STREAM,getprotobyname('tcp')); connect($s,sockaddr_in(80,inet_aton('1.1.1.1'))); close($s); print qq{egress_attempted}"] }
Expand Down
9 changes: 2 additions & 7 deletions example/argocd-server-attacks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,10 +88,6 @@ attacks:
ruleName: Unexpected process launched
containerName: argocd-server
command: cat
- ruleID: R0010
ruleName: Unexpected Sensitive File Access
containerName: argocd-server
command: cat

# ── T1552 — symlink over a sensitive file ───────────────────────────────────
- name: exec-symlink-shadow
Expand Down Expand Up @@ -198,8 +194,7 @@ attacks:
type: cmdinject
exec: { command: ["sh", "-c", "ln /etc/shadow /tmp/shadow.hl >/dev/null 2>&1 && echo hardlink_done; rm -f /tmp/shadow.hl"] }
successIndicators: [{ responseContains: "hardlink_done" }]
expectedDetections:
- { ruleID: R1012, ruleName: Hard link created over sensitive file, containerName: argocd-server, command: ln }
expectedDetections: []
- name: ebpf-program-load
type: cmdinject
exec: { command: ["perl", "-e", "syscall(321,5,0,0); print qq{bpf_probe_done}"] }
Expand All @@ -224,7 +219,7 @@ attacks:
- { ruleID: R1004, ruleName: Process executed from mount, containerName: argocd-server }
- name: fileless-memfd-exec
type: fileless
exec: { command: ["perl", "-e", "my $n=\"bobfl\0\"; my $fd=syscall(319,$n,0); die if $fd<0; open(my $m,'>&='.$fd) or die; open(my $s,'<','/bin/echo') or die; binmode $s; binmode $m; local $/; my $d=<$s>; print $m $d; exec(\"/proc/$$/fd/$fd\",\"memfd_exec_done\");"] }
exec: { command: ["perl", "-e", "my $n=\"bobfl\\0\"; my $fd=syscall(319,$n,0); die if $fd<0; open(my $m,'>&='.$fd) or die; open(my $s,'<','/bin/echo') or die; binmode $s; binmode $m; local $/; my $d=<$s>; print $m $d; exec(\"/proc/$$/fd/$fd\",\"memfd_exec_done\");"] }
successIndicators: [{ responseContains: "memfd_exec_done" }]
expectedDetections:
- { ruleID: R1005, ruleName: Fileless execution detected, containerName: argocd-server }
Comment on lines 220 to 225

@coderabbitai coderabbitai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Remove the unavailable R1005 expectation.

The PR objective states that R1005 is unavailable for argocd-server, but Lines 224-225 still require it. This can prevent the suite from scoring zero. Keep the corrected \\0 escaping on Line 222, but remove the R1005 entry unless the objective and tuning evidence are updated.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@example/argocd-server-attacks.yaml` around lines 220 - 225, Remove the R1005
expectedDetection entry from the fileless-memfd-exec test while preserving the
corrected \0 escaping in its Perl command. Leave the ruleName and containerName
fields unchanged only if they belong to another valid expectation; otherwise
remove the entire unavailable R1005 expectation block.

Expand Down
4 changes: 4 additions & 0 deletions example/argocd/sbobs/cp-argocd-application-controller.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,10 @@ spec:
path: /proc/⋯/stat
- flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
path: /proc/⋯/task/1/fd
- path: /run/secrets/kubernetes.io/serviceaccount
flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
- path: /run/secrets/kubernetes.io/serviceaccount/⋯
flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
- flags: [O_CLOEXEC, O_RDONLY]
path: /run/secrets/kubernetes.io/serviceaccount/⋯/ca.crt
- flags: [O_CLOEXEC, O_RDONLY]
Expand Down
4 changes: 4 additions & 0 deletions example/argocd/sbobs/cp-argocd-applicationset-controller.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,10 @@ spec:
path: /proc/⋯/stat
- flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
path: /proc/⋯/task/1/fd
- path: /run/secrets/kubernetes.io/serviceaccount
flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
- path: /run/secrets/kubernetes.io/serviceaccount/⋯
flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
- flags: [O_CLOEXEC, O_RDONLY]
path: /run/secrets/kubernetes.io/serviceaccount/⋯/ca.crt
- flags: [O_CLOEXEC, O_RDONLY]
Expand Down
4 changes: 4 additions & 0 deletions example/argocd/sbobs/cp-argocd-dex-server.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,10 @@ spec:
path: /etc/passwd
- flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
path: /proc/⋯/task/1/fd
- path: /run/secrets/kubernetes.io/serviceaccount
flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
- path: /run/secrets/kubernetes.io/serviceaccount/⋯
flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
- flags: [O_CLOEXEC, O_RDONLY]
path: /run/secrets/kubernetes.io/serviceaccount/⋯/ca.crt
- flags: [O_CLOEXEC, O_RDONLY]
Expand Down
4 changes: 4 additions & 0 deletions example/argocd/sbobs/cp-argocd-notifications-controller.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,10 @@ spec:
path: /proc/⋯/stat
- flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
path: /proc/⋯/task/1/fd
- path: /run/secrets/kubernetes.io/serviceaccount
flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
- path: /run/secrets/kubernetes.io/serviceaccount/⋯
flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
- flags: [O_CLOEXEC, O_RDONLY]
path: /run/secrets/kubernetes.io/serviceaccount/⋯/ca.crt
- flags: [O_CLOEXEC, O_RDONLY]
Expand Down
4 changes: 4 additions & 0 deletions example/argocd/sbobs/cp-argocd-redis.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,10 @@ spec:
path: /proc/⋯/task/1/fd
- flags: [O_CLOEXEC, O_LARGEFILE, O_RDONLY]
path: /proc/⋯/vm/overcommit_memory
- path: /run/secrets/kubernetes.io/serviceaccount

@entlein entlein Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

check the path prefix for rancher please

flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
- path: /run/secrets/kubernetes.io/serviceaccount/⋯
flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
- flags: [O_CLOEXEC, O_LARGEFILE, O_NONBLOCK, O_RDONLY]
path: /run/secrets/kubernetes.io/serviceaccount/⋯/token
- flags: [O_LARGEFILE, O_RDONLY]
Expand Down
4 changes: 4 additions & 0 deletions example/argocd/sbobs/cp-argocd-server.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,10 @@ spec:
path: /proc/⋯/net/core/somaxconn
- flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
path: /proc/⋯/task/1/fd
- path: /run/secrets/kubernetes.io/serviceaccount
flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
- path: /run/secrets/kubernetes.io/serviceaccount/⋯
flags: [O_CLOEXEC, O_DIRECTORY, O_RDONLY]
- flags: [O_CLOEXEC, O_RDONLY]
path: /run/secrets/kubernetes.io/serviceaccount/⋯/ca.crt
- flags: [O_CLOEXEC, O_RDONLY]
Expand Down
2 changes: 1 addition & 1 deletion pkg
Open in desktop
Submodule pkg updated from 2a2b33 to 085f6c
Loading