Skip to content

Commit 2f82ed6

Browse files
JustinKuliopenshift-merge-robot
authored andcommitted
Set seccomp profile for cfg-policy
Only required on config-policy-controller because of the wide range of permissions that it has. Refs: - https://issues.redhat.com/browse/ACM-4590 Signed-off-by: Justin Kulikauskas <[email protected]>
1 parent b04f668 commit 2f82ed6

File tree

1 file changed

+2
-1
lines changed
  • pkg/addon/configpolicy/manifests/managedclusterchart/templates

1 file changed

+2
-1
lines changed

pkg/addon/configpolicy/manifests/managedclusterchart/templates/deployment.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,6 @@ spec:
131131
containerPort: 8383
132132
{{- end }}
133133
resources: {{- toYaml .Values.resources | nindent 10 }}
134-
securityContext:
135134
allowPrivilegeEscalation: false
136135
capabilities:
137136
drop:
@@ -177,4 +176,6 @@ spec:
177176
serviceAccount: {{ include "controller.serviceAccountName" . }}
178177
securityContext:
179178
runAsNonRoot: true
179+
seccompProfile:
180+
type: RuntimeDefault
180181
terminationGracePeriodSeconds: 120

0 commit comments

Comments
 (0)