-
Notifications
You must be signed in to change notification settings - Fork 3.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ensure securityContext.seccompProfile.type is set #5477
Ensure securityContext.seccompProfile.type is set #5477
Conversation
seccompProfile: | ||
type: RuntimeDefault |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the patch! bundle.yaml
is a generated file (see makefile target bundle.yaml
). Below may be what you are looking for, followed by make generate.
diff --git a/jsonnet/prometheus-operator/prometheus-operator.libsonnet b/jsonnet/prometheus-operator/prometheus-operator.libsonnet
index 7e2688e06..49fa5b37c 100644
--- a/jsonnet/prometheus-operator/prometheus-operator.libsonnet
+++ b/jsonnet/prometheus-operator/prometheus-operator.libsonnet
@@ -33,7 +33,7 @@ function(params) {
if po.config.enableAlertmanagerConfigV1beta1 then
(import 'alertmanagerconfigs-v1beta1-crd.libsonnet')
else {},
- '0prometheusagentCustomResourceDefinition': import 'prometheusagents-crd.json',
+ '0prometheusagentCustomResourceDefinition': import 'prometheusagents-crd.json',
'0prometheusCustomResourceDefinition': import 'prometheuses-crd.json',
'0servicemonitorCustomResourceDefinition': import 'servicemonitors-crd.json',
'0podmonitorCustomResourceDefinition': import 'podmonitors-crd.json',
@@ -178,6 +178,7 @@ function(params) {
securityContext: {
runAsNonRoot: true,
runAsUser: 65534,
+ seccomProfile: 'RuntimeDefault',
},
serviceAccountName: po.config.name,
automountServiceAccountToken: true,
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think I've made the requested changes, the libsonnet does make a lot more sense.
Found via: PodSecurity "restricted:1.26.0"
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
looks good to me. Will request @simonpasquier for final review before merging.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
thanks!
Description
This sets the default value for
securityContext.seccompProfile.type
. When running with warnings forPodSecurity "restricted:1.26.0
a message is emitted that this is unset.Message
As
RuntimeDefault
is already the used default this should have no user facing changes.Type of change
What type of changes does your code introduce to the Prometheus operator? Put an
x
in the box that apply.CHANGE
(fix or feature that would cause existing functionality to not work as expected)FEATURE
(non-breaking change which adds functionality)BUGFIX
(non-breaking change which fixes an issue)ENHANCEMENT
(non-breaking change which improves existing functionality)NONE
(if none of the other choices apply. Example, tooling, build system, CI, docs, etc.)Changelog entry
Please put a one-line changelog entry below. This will be copied to the changelog file during the release process.