Set seccompProfile to ensure that deployment is successful on PSA enforced cluster.

[rohitagg2020]

What steps did you take:
Given I have Kubernetes cluster with Pod Security Admission set to enforced. When I deployed kapp-controller on the Kubernetes cluster, kapp-controller pod doesn't come up and deployment fails:

$ kubectl get deploy/kapp-controller -n kapp-controller -oyaml | yq .status
availableReplicas: 1
conditions:
  - lastTransitionTime: "2024-01-28T07:14:03Z"
    lastUpdateTime: "2024-01-28T07:14:03Z"
    message: Deployment has minimum availability.
    reason: MinimumReplicasAvailable
    status: "True"
    type: Available
  - lastTransitionTime: "2024-01-28T07:13:33Z"
    lastUpdateTime: "2024-01-28T07:15:04Z"
    message: Created new replica set "kapp-controller-6b8d5dc9d8"
    reason: NewReplicaSetCreated
    status: "True"
    type: Progressing
  - lastTransitionTime: "2024-01-28T07:15:04Z"
    lastUpdateTime: "2024-01-28T07:15:04Z"
    message: 'admission webhook "pod-security-webhook.kubernetes.io" denied the request: pods "kapp-controller-6b8d5dc9d8-ghkg6" is forbidden: violates PodSecurity "restricted:latest": seccompProfile (pod or containers "kapp-controller", "kapp-controller-sidecarexec" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")'
    reason: FailedCreate
    status: "True"
    type: ReplicaFailure
observedGeneration: 2
readyReplicas: 1
replicas: 1
unavailableReplicas: 1

What happened:
Kapp-controller deployment fails to bring up the pod.

What did you expect:
Kapp-controller deployment to be running successfully.

Anything else you would like to add:
Setting the seccompProfile to RuntimeDefault will also harden the container security.

Environment:

• kapp Controller version (execute kubectl get deployment -n kapp-controller kapp-controller -o yaml and the annotation is kbld.k14s.io/images):
• Kubernetes version (use kubectl version)

---

Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.