Merge pull request #3399 from chrischdi/prepare-securitycontext-for-psa

add explicit securityContexts to the controller and namespace label for privileged
kubernetes-sigs · Apr 21, 2023 · 7bed3d0 · 7bed3d0
2 parents 94b703e + 4aeec5e
commit 7bed3d0
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/config/default/namespace.yaml b/config/default/namespace.yaml
@@ -2,3 +2,6 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: system
+  labels:
+    # this is required due to the nmi daemonset
+    pod-security.kubernetes.io/enforce: privileged
diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
@@ -57,6 +57,17 @@ spec:
             valueFrom:
               fieldRef:
                 fieldPath: metadata.namespace
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            runAsUser: 65532
+            runAsGroup: 65532
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       terminationGracePeriodSeconds: 10
       serviceAccountName: manager
       tolerations: