-
Notifications
You must be signed in to change notification settings - Fork 30
Description
Preflight Checklist
- I have searched the issue tracker for an issue that matches the one I want to file, without success.
- I agree to follow the Code of Conduct.
Problem Description
Vault operator does not allow to specify securityContext for the vaultConfigurer pod container, it only allows to specify the podSecurityContext for the whole pod
This is not sufficient in all cases. For example, we deploy in a managed rancher kubernetes cluster with strict security policies. All containers are forced to have the following security profile or they won't be scheduled:
securityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
drop: [ "ALL" ]
seccompProfile:
type: RuntimeDefaultSome but not all of them can be set by using the pods security context on a pod level, however, e.g., allowPrivilegeEscalation and capabilities can only be set on a container level
This missing feature prevents us from using bank-vaults operator, because it is impossible for us to deploy the vaultConfigurer pod
Proposed Solution
Add a vaultConfigurerContainerSpec that allows to configure/extend container spec for vaultConfigurer - similar to the already existing vaultContainerSpec - to the VaultSpec API
Alternatives Considered
No response
Additional Information
No response
Metadata
Metadata
Assignees
Labels
Type
Projects
Status