Merge pull request #49 from IBM/bha-code-engine-fix

add security params based on code engine review

Author: Bhagyashreek8

config/manager/manager.yaml

@@ -71,6 +71,8 @@ spec:
         name: manager
         securityContext:
           allowPrivilegeEscalation: false
+          seccompProfile:
+              type: RuntimeDefault
           capabilities:
             drop:
               - "ALL"

controllers/syncer/csi_controller.go

@@ -158,7 +158,12 @@ func (s *csiControllerSyncer) ensureContainersSpec() []corev1.Container {
 }
 
 func (s *csiControllerSyncer) ensureContainer(name, image string, args []string) corev1.Container {
-	sc := &corev1.SecurityContext{AllowPrivilegeEscalation: util.False()}
+	sc := &corev1.SecurityContext{
+		AllowPrivilegeEscalation: util.False(),
+		SeccompProfile: &corev1.SeccompProfile{
+			Type: corev1.SeccompProfileTypeRuntimeDefault,
+		},
+	}
 	fillSecurityContextCapabilities(sc)
 	return corev1.Container{
 		Name:  name,

controllers/syncer/csi_node.go

@@ -156,7 +156,11 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container {
 	)
 	registrar.SecurityContext = &corev1.SecurityContext{RunAsNonRoot: util.False(),
 		RunAsUser:  func(uid int64) *int64 { return &uid }(0),
-		Privileged: util.False()}
+		Privileged: util.False(),
+		SeccompProfile: &corev1.SeccompProfile{
+			Type: corev1.SeccompProfileTypeRuntimeDefault,
+		},
+	}
 	fillSecurityContextCapabilities(registrar.SecurityContext)
 	registrar.ImagePullPolicy = s.getCSINodeDriverRegistrarPullPolicy()
 	registrar.Resources = getSidecarResourceRequests(s.driver, constants.CSINodeDriverRegistrar)