Add allowPrivilegeEscalation=false to pods (#429)

* Add allowPrivilegeEscalation=false to pods * Add openshift check * Add injector openshift check
hashicorp · Dec 14, 2020 · cc20c0b · cc20c0b
1 parent d80432a
commit cc20c0b
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/templates/injector-deployment.yaml b/templates/injector-deployment.yaml
@@ -46,6 +46,10 @@ spec:
           {{ template "injector.resources" . }}
           image: "{{ .Values.injector.image.repository }}:{{ .Values.injector.image.tag }}"
           imagePullPolicy: "{{ .Values.injector.image.pullPolicy }}"
+          {{- if not .Values.global.openshift }}
+          securityContext:
+            allowPrivilegeEscalation: false
+          {{- end }}
           env:
             - name: AGENT_INJECT_LISTEN
               value: ":8080"

diff --git a/templates/server-statefulset.yaml b/templates/server-statefulset.yaml
@@ -70,6 +70,10 @@ spec:
           - "/bin/sh"
           - "-ec"
           args: {{ template "vault.args" . }}
+          {{- if not .Values.global.openshift }}
+          securityContext:
+            allowPrivilegeEscalation: false
+          {{- end }}
           env:
             - name: HOST_IP
               valueFrom: