chart: add customizable security-context (#716)

drop all privileges and enforce user/group/fsgroup Signed-off-by: Francesco Giudici <[email protected]>
rancher · May 2, 2024 · a147e8a · a147e8a
1 parent 8038dc6
commit a147e8a
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/.obs/chartfile/operator/templates/deployment.yaml b/.obs/chartfile/operator/templates/deployment.yaml
@@ -12,6 +12,10 @@ spec:
       labels:
         app: elemental-operator
     spec:
+      securityContext:
+        runAsUser: {{ .Values.securityContext.runAsUser }}
+        runAsGroup: {{ .Values.securityContext.runAsGroup }}
+        fsGroup: {{ .Values.securityContext.fsGroup }}
       containers:
       - env:
         - name: NO_PROXY
@@ -39,6 +43,11 @@ spec:
         - {{ template "registry_url" . }}{{ .Values.seedImage.repository }}:{{ .Values.seedImage.tag | default .Chart.AppVersion }}
         - --seedimage-image-pullpolicy
         - {{ .Values.seedImage.imagePullPolicy}}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
       serviceAccountName: {{ .Release.Name }}
       {{- with .Values.tolerations }}
       tolerations:

diff --git a/.obs/chartfile/operator/values.yaml b/.obs/chartfile/operator/values.yaml
@@ -35,6 +35,11 @@ debug: false
 nodeSelector:
   kubernetes.io/os: linux
 
+securityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+  fsGroup: 2000
+
 tolerations:
   - key: cattle.io/os
     operator: "Equal"