add required values for pss policies

giantswarm · Jul 10, 2023 · 73410cb · 73410cb
1 parent 8a7b9dc
commit 73410cb
Show file tree

Hide file tree

Showing 3 changed files with 29 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Add required values for pss policies.
+
 ## [1.9.1] - 2023-06-28
 
 ### Added

diff --git a/helm/aws-pod-identity-webhook/values.schema.json b/helm/aws-pod-identity-webhook/values.schema.json
@@ -60,6 +60,10 @@
                             "type": "string"
                         }
                     }
+                },
+                "runAsNonRoot": {
+                    "type": "boolean",
+                    "default": true
                 }
             }
         },
@@ -120,6 +124,22 @@
                             "type": "string"
                         }
                     }
+                },
+                "allowPrivilegeEscalation": {
+                    "type": "boolean",
+                    "default": false
+                },
+                "capabilities":{
+                    "type": "object",
+                    "properties": {
+                        "drop": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            },
+                            "default": ["ALL"]
+                        }
+                    }
                 }
             }
         },

diff --git a/helm/aws-pod-identity-webhook/values.yaml b/helm/aws-pod-identity-webhook/values.yaml
@@ -50,6 +50,7 @@ restarter:
 
 # Add seccomp to pod security context
 podSecurityContext:
+  runAsNonRoot: true
   runAsUser: 1000
   seccompProfile:
     type: RuntimeDefault
@@ -58,3 +59,7 @@ podSecurityContext:
 securityContext:
   seccompProfile:
     type: RuntimeDefault
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+    - ALL