fix(manifests): Drop capabilities, add CNCF badge. Fixes #2614 (#4633)

Signed-off-by: Alex Collins <alex_collins@intuit.com>
argoproj · Dec 3, 2020 · 30e172d · 30e172d
1 parent f726b9f
commit 30e172d
Show file tree

Hide file tree

Showing 9 changed files with 50 additions and 1 deletion.
diff --git a/Dockerfile b/Dockerfile
@@ -46,7 +46,7 @@ RUN if [ "${IMAGE_OS}" = "linux" ]; then \
 # argoexec-base
 # Used as the base for both the release and development version of argoexec
 ####################################################################################################
-FROM debian:10.3-slim as argoexec-base
+FROM debian:10.6-slim as argoexec-base
 
 ARG IMAGE_OS=linux
 

diff --git a/README.md b/README.md
@@ -1,5 +1,6 @@
 [![slack](https://img.shields.io/badge/slack-argoproj-brightgreen.svg?logo=slack)](https://argoproj.github.io/community/join-slack)
 [![CI](https://github.com/argoproj/argo/workflows/CI/badge.svg)](https://github.com/argoproj/argo/actions?query=event%3Apush+branch%3Amaster)
+[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/3830/badge)](https://bestpractices.coreinfrastructure.org/projects/3830)
 
 ![Argo Image](docs/assets/argo.png)
 

diff --git a/manifests/base/argo-server/argo-server-deployment.yaml b/manifests/base/argo-server/argo-server-deployment.yaml
@@ -15,6 +15,10 @@ spec:
       containers:
         - name: argo-server
           image: argoproj/argocli:latest
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
           args: [ server ]
           ports:
             - name: web

diff --git a/manifests/base/workflow-controller/workflow-controller-deployment.yaml b/manifests/base/workflow-controller/workflow-controller-deployment.yaml
@@ -15,6 +15,10 @@ spec:
       containers:
         - name: workflow-controller
           image: argoproj/workflow-controller:latest
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
           command:
             - workflow-controller
           args:

diff --git a/manifests/install.yaml b/manifests/install.yaml
@@ -471,6 +471,10 @@ spec:
             scheme: HTTP
           initialDelaySeconds: 10
           periodSeconds: 20
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
         volumeMounts:
         - mountPath: /tmp
           name: tmp
@@ -506,6 +510,10 @@ spec:
         - workflow-controller
         image: argoproj/workflow-controller:latest
         name: workflow-controller
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
       nodeSelector:
         kubernetes.io/os: linux
       securityContext:

diff --git a/manifests/namespace-install.yaml b/manifests/namespace-install.yaml
@@ -365,6 +365,10 @@ spec:
             scheme: HTTP
           initialDelaySeconds: 10
           periodSeconds: 20
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
         volumeMounts:
         - mountPath: /tmp
           name: tmp
@@ -401,6 +405,10 @@ spec:
         - workflow-controller
         image: argoproj/workflow-controller:latest
         name: workflow-controller
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
       nodeSelector:
         kubernetes.io/os: linux
       securityContext:

diff --git a/manifests/quick-start-minimal.yaml b/manifests/quick-start-minimal.yaml
@@ -618,6 +618,10 @@ spec:
             scheme: HTTP
           initialDelaySeconds: 10
           periodSeconds: 20
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
         volumeMounts:
         - mountPath: /tmp
           name: tmp
@@ -654,6 +658,10 @@ spec:
         - workflow-controller
         image: argoproj/workflow-controller:latest
         name: workflow-controller
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
       nodeSelector:
         kubernetes.io/os: linux
       securityContext:

diff --git a/manifests/quick-start-mysql.yaml b/manifests/quick-start-mysql.yaml
@@ -662,6 +662,10 @@ spec:
             scheme: HTTP
           initialDelaySeconds: 10
           periodSeconds: 20
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
         volumeMounts:
         - mountPath: /tmp
           name: tmp
@@ -743,6 +747,10 @@ spec:
         - workflow-controller
         image: argoproj/workflow-controller:latest
         name: workflow-controller
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
       nodeSelector:
         kubernetes.io/os: linux
       securityContext:

diff --git a/manifests/quick-start-postgres.yaml b/manifests/quick-start-postgres.yaml
@@ -662,6 +662,10 @@ spec:
             scheme: HTTP
           initialDelaySeconds: 10
           periodSeconds: 20
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
         volumeMounts:
         - mountPath: /tmp
           name: tmp
@@ -735,6 +739,10 @@ spec:
         - workflow-controller
         image: argoproj/workflow-controller:latest
         name: workflow-controller
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
       nodeSelector:
         kubernetes.io/os: linux
       securityContext: