Running SigNoz on a Kyverno-enforced cluster, I can't set allowPrivilegeEscalation: false or capabilities.drop: [ALL] on the clickhouse-operator and telemetryStoreMigrator containers — there's no values key for it.
The clickhouse-operator Deployment has two containers (operator and metrics-exporter) with no securityContext block in the template. The telemetryStoreMigrator Job has the same problem across all four of its containers (ready, bootstrap, sync, async).
Other components like signoz and otelCollector already expose securityContext in values and wire it through the template — would be great to have the same for these two.
Note: ClickHouse pod securityContext is tracked separately in #852.
Running SigNoz on a Kyverno-enforced cluster, I can't set
allowPrivilegeEscalation: falseorcapabilities.drop: [ALL]on theclickhouse-operatorandtelemetryStoreMigratorcontainers — there's no values key for it.The
clickhouse-operatorDeployment has two containers (operatorandmetrics-exporter) with nosecurityContextblock in the template. ThetelemetryStoreMigratorJob has the same problem across all four of its containers (ready,bootstrap,sync,async).Other components like
signozandotelCollectoralready exposesecurityContextin values and wire it through the template — would be great to have the same for these two.Note: ClickHouse pod
securityContextis tracked separately in #852.