helm: run continuous-test under restricted policy (#8654)

grafana · Jul 8, 2024 · cb27ea3 · cb27ea3
1 parent 8336e18
commit cb27ea3
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/operations/helm/charts/mimir-distributed/CHANGELOG.md b/operations/helm/charts/mimir-distributed/CHANGELOG.md
@@ -33,6 +33,7 @@ Entries should include a reference to the Pull Request that introduced the chang
   * Overview dashboard: status, read/write latency and queries/ingestion per sec panels, `cortex_request_duration_seconds` metric.
 * [ENHANCEMENT] Memcached: Update to Memcached 1.6.28 and memcached-exporter 0.14.4. #8557
 * [ENHANCEMENT] Add missing fields in multiple topology spread constraints. #8533
+* [BUGFIX] Add missing container security context to run `continuous-test` under the restricted security policy. #8653
 
 ## 5.4.0-rc.0
 

diff --git a/operations/helm/charts/mimir-distributed/values.yaml b/operations/helm/charts/mimir-distributed/values.yaml
@@ -4376,6 +4376,9 @@ continuous_test:
   # -- The SecurityContext for continuous test containers
   containerSecurityContext:
     readOnlyRootFilesystem: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: [ALL]
   # -- Extra environment variables for continuous test containers
   env: []
   # -- Extra command line arguments for the continuous test container