{
  "schemaVersion": "catalog-shared-check-receipt-v1",
  "subject": {
    "id": "runix-pgadmin4-1-62-0-default",
    "chart": "runix/pgadmin4",
    "version": "1.62.0",
    "base": "default",
    "renderPath": "recipes/runix/pgadmin4/1.62.0/revisions/default/r001/rendered/release-objects.yaml",
    "renderFileSHA256": "sha256:78528d11d3b5ea8cf8c03e43834edbe87a944df1593c516867cc4e0389ba1565"
  },
  "catalogReview": {
    "path": "recipes/runix/pgadmin4/1.62.0/revisions/default/r001/receipts/scan-receipt.yaml",
    "note": "Separate chart-specific Catalog review; not a cub check result."
  },
  "scannerResult": {
    "schema_version": "risk-scan-findings-v1",
    "surface": "cub-scan",
    "finding_count": 7,
    "findings": [
      {
        "id": "CCVE-2025-3728",
        "name": "Deployment containers omit resource limits",
        "category": "CONFIG",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "pgadmin4",
          "namespace": "default"
        },
        "message": "Deployment containers omit resource limits",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Add resources.limits for memory and CPU to each container",
            "Add resources.requests to enable proper scheduling",
            "Consider LimitRange defaults at the namespace level"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o yaml | grep -A10 resources",
            "kubectl set resources deployment <name> -n <namespace> --limits=cpu=500m,memory=256Mi --requests=cpu=100m,memory=128Mi"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0002"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Add resources.limits for memory and CPU to each container",
          "command": "kubectl get deployment <name> -n <namespace> -o yaml | grep -A10 resources",
          "doc_ref": "cub-scan --explain CCVE-2025-3728"
        }
      },
      {
        "id": "CCVE-2025-3732",
        "name": "Deployment containers omit resource requests",
        "category": "CONFIG",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "pgadmin4",
          "namespace": "default"
        },
        "message": "Deployment containers omit resource requests; HPA and scheduler decisions will be unreliable",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set resources.requests.cpu and resources.requests.memory on every container",
            "Align requests with observed steady-state usage",
            "Ensure requests are set when using HPA"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].resources}'"
          ]
        },
        "evidence_source": "native",
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set resources.requests.cpu and resources.requests.memory on every container",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].resources}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3732"
        }
      },
      {
        "id": "CCVE-2025-3733",
        "name": "Container does not set runAsNonRoot",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "critical",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "pgadmin4",
          "namespace": "default"
        },
        "message": "Container pgadmin4 does not set runAsNonRoot: true",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set securityContext.runAsNonRoot to true at pod or container level",
            "Set runAsUser to a non-zero UID",
            "Ensure container images do not require root"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.securityContext}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0001"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set securityContext.runAsNonRoot to true at pod or container level",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.securityContext}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3733"
        }
      },
      {
        "id": "CCVE-2025-3734",
        "name": "Container does not disable allowPrivilegeEscalation",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "critical",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "pgadmin4",
          "namespace": "default"
        },
        "message": "Container pgadmin4 does not set allowPrivilegeEscalation: false",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set securityContext.allowPrivilegeEscalation to false on every container",
            "Ensure no setuid binaries are needed in the container image"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0001"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set securityContext.allowPrivilegeEscalation to false on every container",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3734"
        }
      },
      {
        "id": "CCVE-2025-3735",
        "name": "Container does not enforce readOnlyRootFilesystem",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "pgadmin4",
          "namespace": "default"
        },
        "message": "Container pgadmin4 does not set readOnlyRootFilesystem: true",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set securityContext.readOnlyRootFilesystem to true on every container",
            "Use emptyDir or tmpfs mounts for directories that need write access"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0001"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set securityContext.readOnlyRootFilesystem to true on every container",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3735"
        }
      },
      {
        "id": "CCVE-2025-3736",
        "name": "Container does not drop ALL capabilities",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "pgadmin4",
          "namespace": "default"
        },
        "message": "Container pgadmin4 does not drop ALL capabilities",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set securityContext.capabilities.drop to [\"ALL\"] on every container",
            "Add back only specifically needed capabilities via capabilities.add"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext.capabilities}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-WORKLOAD-0001"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set securityContext.capabilities.drop to [\"ALL\"] on every container",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.template.spec.containers[*].securityContext.capabilities}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3736"
        }
      },
      {
        "id": "CCVE-2025-3740",
        "name": "Deployment explicitly sets replicas to 1",
        "category": "CONFIG",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "info",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "Deployment",
          "name": "pgadmin4",
          "namespace": "default"
        },
        "message": "Deployment has replicas: 1; no high availability",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set replicas to at least 2 for services requiring availability",
            "Use HPA with minReplicas >= 2 for auto-scaling workloads",
            "Single replica is acceptable for batch jobs or development"
          ],
          "commands": [
            "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.replicas}'"
          ]
        },
        "evidence_source": "native",
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set replicas to at least 2 for services requiring availability",
          "command": "kubectl get deployment <name> -n <namespace> -o jsonpath='{.spec.replicas}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3740"
        }
      }
    ],
    "provenance": {
      "source": "cub-scan",
      "source_version": "v0.7.3",
      "scan_time": "2026-08-24T16:00:50Z",
      "catalog_version": "risk-catalog-v1.json@7ff79a126ad9"
    },
    "pattern_bundle": {
      "schema_version": "bundle-manifest-v1",
      "version": "v0.7.3",
      "source_repo": "confighubai/confighub-scan",
      "manifest_sha256": "0405f6ffe21e567adf5d6a732d181c7f228194920456d046b4338baeb14de1a8",
      "catalog_sha256": "7ff79a126ad99bba2505fec8b2b7711c03f50eb362141128ec1c83e27a5036ba"
    },
    "input": {
      "object_count": 5,
      "object_set_sha256": "sha256:c790c3037c0ad1324cce9f457a5c7f9c2a3af75ce8ec81a954612b52a8e2dd5e"
    }
  }
}