Skip to content

Commit 285500f

Browse files
committed
Add pod security contexts
Enforces Pod Security Standards v1.23 Ensures HNC container process will comply with latest security rules, process isolation etc https://kubernetes.io/docs/concepts/security/pod-security-standards/ Tested: make test-e2e ran successful --- PASS: TestE2e (541.48s) PASS ok sigs.k8s.io/hierarchical-namespaces/test/e2e 541.484s
1 parent c566204 commit 285500f

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

config/manager/manager.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ kind: Namespace
33
metadata:
44
labels:
55
control-plane: controller-manager
6+
pod-security.kubernetes.io/enforce: restricted
7+
pod-security.kubernetes.io/enforce-version: v1.23
68
name: system
79
---
810
apiVersion: apps/v1
@@ -57,6 +59,14 @@ spec:
5759
- containerPort: 8080
5860
name: metrics
5961
protocol: TCP
62+
securityContext:
63+
allowPrivilegeEscalation: false
64+
readOnlyRootFilesystem: true
65+
runAsNonRoot: true
66+
seccompProfile:
67+
type: RuntimeDefault
68+
capabilities:
69+
drop: ["ALL"]
6070
volumeMounts:
6171
- mountPath: /tmp/k8s-webhook-server/serving-certs
6272
name: cert

0 commit comments

Comments
 (0)