---
id: security-context-off
name: "Capability: no securityContext when knobs unset (OFF)"
description: >-
  Renders the product chart with default values (no securityContext overrides)
  and asserts that no pod-level or container-level securityContext block is
  present on any workload. Since the chart has no securityContext templates,
  no securityContext blocks are ever emitted. This scenario is EXPECTED to
  PASS — confirming no securityContext leakage when the knob is off.
labels: {customer: enterprise, profile: compliance}
cluster:
  provider: kind
  k8s_version: v1.36.1
product:
  chart: ./chart
  release: sample
  namespace: sample
asserts:
  - type: security-context
    namespace: sample
    source: rendered
    expect_present: false
tags: [capability, compliance]
category: capability
capability: pod-security
tier: capability
mechanisms: ["capability:security-context"]