fix would violate PodSecurity restricted:latest: unrestricted capabil…

…ities, add securityContext in values.yaml Signed-off-by: yanhu.cheng <[email protected]>
open-policy-agent · Sep 6, 2022 · da1e6fc · da1e6fc
1 parent e31c1d7
commit da1e6fc
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/charts/external-data-provider/templates/external-data-provider-deployment.yaml b/charts/external-data-provider/templates/external-data-provider-deployment.yaml
@@ -34,6 +34,9 @@ spec:
  mountPath: /tmp/gatekeeper
  readOnly: true
  {{- end }}
+ securityContext:
+ {{- toYaml .Values.securityContext | nindent 12 }}
+
  restartPolicy: Always
  nodeSelector:
  kubernetes.io/os: linux

diff --git a/charts/external-data-provider/values.yaml b/charts/external-data-provider/values.yaml
@@ -7,3 +7,12 @@ provider:
  enabled: true
  caBundle: ""
  skipVerify: false
+
+securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ runAsNonRoot: true
+ seccompProfile:
+ type: RuntimeDefault