Merge pull request #83 from s-urbaniak/patch-3

manifests/deployment: comply to restricted pod security level
openshift · Apr 28, 2022 · b746289 · b746289
2 parents 9030c0d + 60a349c
commit b746289
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 0 deletions.
diff --git a/manifests/07_deployment-ibm-cloud-managed.yaml b/manifests/07_deployment-ibm-cloud-managed.yaml
@@ -49,6 +49,10 @@ spec:
             cpu: 10m
             memory: 50Mi
         securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
           runAsUser: 1001
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
@@ -57,6 +61,10 @@ spec:
         - mountPath: /var/run/secrets/serving-cert
           name: serving-cert
       priorityClassName: system-cluster-critical
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: kube-storage-version-migrator-operator
       tolerations:
       - effect: NoSchedule

diff --git a/manifests/07_deployment.yaml b/manifests/07_deployment.yaml
@@ -39,6 +39,10 @@ spec:
             memory: 50Mi
             cpu: 10m
         securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
           runAsUser: 1001
         volumeMounts:
           - mountPath: /var/run/configmaps/config
@@ -65,6 +69,10 @@ spec:
       nodeSelector:
         node-role.kubernetes.io/master: ""
       priorityClassName: "system-cluster-critical"
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       tolerations:
       - key: "node-role.kubernetes.io/master"
         operator: "Exists"