Add securitycontext for k8s 1.25

For k8s 1.25, a securityContext definition is needed for a pod. Add proper security context to pipelineloop controler and webhook Signed-off-by: Yihong Wang <[email protected]>
kubeflow · Jan 26, 2023 · 90ba362 · 90ba362
1 parent b3579dd
commit 90ba362
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/manifests/kustomize/third-party/tekton-custom-task/pipeline-loops/500-controller.yaml b/manifests/kustomize/third-party/tekton-custom-task/pipeline-loops/500-controller.yaml
@@ -54,3 +54,13 @@ spec:
           value: config-observability
         - name: METRICS_DOMAIN
           value: tekton.dev/pipeline
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65532
+          seccompProfile:
+            type: RuntimeDefault
diff --git a/manifests/kustomize/third-party/tekton-custom-task/pipeline-loops/500-webhook.yaml b/manifests/kustomize/third-party/tekton-custom-task/pipeline-loops/500-webhook.yaml
@@ -64,6 +64,16 @@ spec:
           containerPort: 8008
         - name: https-webhook
           containerPort: 8443
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65532
+          seccompProfile:
+            type: RuntimeDefault
 ---
 apiVersion: v1
 kind: Service