Drop Security Context (#457)

Author: ajanikow

chart/kube-arangodb/templates/NOTES.txt

@@ -0,0 +1,7 @@
+You have installed Kubernetes ArangoDB Operator in version {{ .Chart.Version }}
+
+To access ArangoDeployments you can use:
+
+kubectl --namespace "{{ .Release.Namespace }}" get arangodeployments
+
+More details can be found on https://github.com/arangodb/kube-arangodb/tree/{{ .Chart.Version }}/docs

chart/kube-arangodb/templates/deployment.yaml

@@ -46,6 +46,9 @@ spec:
                           operator: In
                           values:
                             - amd64
+            hostNetwork: false
+            hostPID: false
+            hostIPC: false
             containers:
                 - name: operator
                   imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
@@ -81,9 +84,12 @@ spec:
                       - name: metrics
                         containerPort: 8528
                   securityContext:
-                    capabilities:
-                      drop:
-                        - 'ALL'
+                      privileged: false
+                      allowPrivilegeEscalation: false
+                      readOnlyRootFilesystem: true
+                      capabilities:
+                          drop:
+                              - 'ALL'
 {{- if .Values.operator.resources }}
                   resources:
 {{ toYaml .Values.operator.resources | indent 22 }}

manifests/arango-deployment-replication.yaml

@@ -168,6 +168,9 @@ spec:
                           operator: In
                           values:
                             - amd64
+            hostNetwork: false
+            hostPID: false
+            hostIPC: false
             containers:
                 - name: operator
                   imagePullPolicy: Always
@@ -193,9 +196,12 @@ spec:
                       - name: metrics
                         containerPort: 8528
                   securityContext:
-                    capabilities:
-                      drop:
-                        - 'ALL'
+                      privileged: false
+                      allowPrivilegeEscalation: false
+                      readOnlyRootFilesystem: true
+                      capabilities:
+                          drop:
+                              - 'ALL'
                   livenessProbe:
                       httpGet:
                           path: /health

manifests/arango-deployment.yaml

@@ -215,6 +215,9 @@ spec:
                           operator: In
                           values:
                             - amd64
+            hostNetwork: false
+            hostPID: false
+            hostIPC: false
             containers:
                 - name: operator
                   imagePullPolicy: Always
@@ -240,9 +243,12 @@ spec:
                       - name: metrics
                         containerPort: 8528
                   securityContext:
-                    capabilities:
-                      drop:
-                        - 'ALL'
+                      privileged: false
+                      allowPrivilegeEscalation: false
+                      readOnlyRootFilesystem: true
+                      capabilities:
+                          drop:
+                              - 'ALL'
                   livenessProbe:
                       httpGet:
                           path: /health

manifests/arango-storage.yaml

@@ -200,6 +200,9 @@ spec:
                           operator: In
                           values:
                             - amd64
+            hostNetwork: false
+            hostPID: false
+            hostIPC: false
             containers:
                 - name: operator
                   imagePullPolicy: Always
@@ -225,9 +228,12 @@ spec:
                       - name: metrics
                         containerPort: 8528
                   securityContext:
-                    capabilities:
-                      drop:
-                        - 'ALL'
+                      privileged: false
+                      allowPrivilegeEscalation: false
+                      readOnlyRootFilesystem: true
+                      capabilities:
+                          drop:
+                              - 'ALL'
                   livenessProbe:
                       httpGet:
                           path: /health