Drop NET_BIND_SERVICE cap as it isn't necessary

NET_BIND_SERVICE is only necessary for applications the require access to privileged ports, eg. ports under 1024. Since we are using ports that any user may listen on, this is unnecessary
tektoncd · Nov 13, 2023 · b143afe · b143afe
1 parent 7f632ad
commit b143afe
Show file tree

Hide file tree

Showing 2 changed files with 0 additions and 4 deletions.
diff --git a/config/base/api.yaml b/config/base/api.yaml
@@ -86,8 +86,6 @@ spec:
             capabilities:
               drop:
                 - ALL
-              add:
-                - NET_BIND_SERVICE
       volumes:
         - name: config
           configMap:

diff --git a/config/base/watcher.yaml b/config/base/watcher.yaml
@@ -72,8 +72,6 @@ spec:
             capabilities:
               drop:
                 - ALL
-              add:
-                - NET_BIND_SERVICE
       volumes:
         - name: tls
           secret: