restricted scc (kedacore#41)

Signed-off-by: Zbynek Roubalik <[email protected]>
wozniakjan · Oct 18, 2024 · 61f884e · 61f884e
1 parent d8f91c1
commit 61f884e
Show file tree

Hide file tree

Showing 4 changed files with 13 additions and 5 deletions.
diff --git a/http-add-on/templates/interceptor/deployment.yaml b/http-add-on/templates/interceptor/deployment.yaml
@@ -20,13 +20,15 @@ spec:
       imagePullSecrets: 
         {{- toYaml .Values.interceptor.imagePullSecrets | nindent 8 }}
       serviceAccountName: {{ .Chart.Name }}-interceptor
+      {{- if .Values.podSecurityContext }}
       {{- if .Values.podSecurityContext.interceptor }}
       securityContext:
       {{- toYaml .Values.podSecurityContext.interceptor | nindent 8 }}
       {{- else }}
       securityContext:
       {{- toYaml .Values.podSecurityContext | nindent 8 }}
       {{- end }}
+      {{- end }}
       containers:
       - args:
           - "--zap-log-level={{ .Values.logging.interceptor.level }}"

diff --git a/http-add-on/templates/operator/deployment.yaml b/http-add-on/templates/operator/deployment.yaml
@@ -22,13 +22,15 @@ spec:
       imagePullSecrets: 
         {{- toYaml .Values.operator.imagePullSecrets | nindent 8 }}
       serviceAccountName: {{ .Chart.Name }}
+      {{- if .Values.podSecurityContext }}
       {{- if .Values.podSecurityContext.operator }}
       securityContext:
       {{- toYaml .Values.podSecurityContext.operator | nindent 8 }}
       {{- else }}
       securityContext:
       {{- toYaml .Values.podSecurityContext | nindent 8 }}
       {{- end }}
+      {{- end }}
       containers:
       - args:
         - --secure-listen-address=0.0.0.0:{{ .Values.operator.port | default 8443 }}

diff --git a/http-add-on/templates/scaler/deployment.yaml b/http-add-on/templates/scaler/deployment.yaml
@@ -21,13 +21,15 @@ spec:
       imagePullSecrets: 
         {{- toYaml .Values.scaler.imagePullSecrets | nindent 8 }}
       serviceAccountName: {{ .Chart.Name }}-external-scaler
+      {{- if .Values.podSecurityContext }}
       {{- if .Values.podSecurityContext.scaler }}
       securityContext:
       {{- toYaml .Values.podSecurityContext.scaler | nindent 8 }}
-      {{- else }}
+      {{- else if .Values.podSecurityContext }}
       securityContext:
       {{- toYaml .Values.podSecurityContext | nindent 8 }}
       {{- end }}
+      {{- end }}
       containers:
       - args:
           - "--zap-log-level={{ .Values.logging.scaler.level }}"

diff --git a/http-add-on/values.yaml b/http-add-on/values.yaml
@@ -245,6 +245,8 @@ securityContext:
     - ALL
   privileged: false
   readOnlyRootFilesystem: true
+  seccompProfile:
+    type: RuntimeDefault
   # runAsUser: 1000
   # runAsGroup: 1000
   # operator:
@@ -282,10 +284,10 @@ securityContext:
 
 # --  [Pod security context] for all pods
 # @default -- [See below](#KEDA-is-secure-by-default)
-podSecurityContext:
-  fsGroup: 1000
-  supplementalGroups:
-  - 1000
+# podSecurityContext:
+#   fsGroup: 1000
+#   supplementalGroups:
+#   - 1000
   # operator:
     # runAsNonRoot: true
     # runAsUser: 1000