Skip to content
This repository was archived by the owner on Apr 17, 2025. It is now read-only.

Commit 285500f

Browse files
committed
Add pod security contexts
Enforces Pod Security Standards v1.23 Ensures HNC container process will comply with latest security rules, process isolation etc https://kubernetes.io/docs/concepts/security/pod-security-standards/ Tested: make test-e2e ran successful --- PASS: TestE2e (541.48s) PASS ok sigs.k8s.io/hierarchical-namespaces/test/e2e 541.484s
1 parent c566204 commit 285500f

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

config/manager/manager.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ kind: Namespace
33
metadata:
44
labels:
55
control-plane: controller-manager
6+
pod-security.kubernetes.io/enforce: restricted
7+
pod-security.kubernetes.io/enforce-version: v1.23
68
name: system
79
---
810
apiVersion: apps/v1
@@ -57,6 +59,14 @@ spec:
5759
- containerPort: 8080
5860
name: metrics
5961
protocol: TCP
62+
securityContext:
63+
allowPrivilegeEscalation: false
64+
readOnlyRootFilesystem: true
65+
runAsNonRoot: true
66+
seccompProfile:
67+
type: RuntimeDefault
68+
capabilities:
69+
drop: ["ALL"]
6070
volumeMounts:
6171
- mountPath: /tmp/k8s-webhook-server/serving-certs
6272
name: cert

0 commit comments

Comments
 (0)