Merge pull request #53 from rptaylor/20241030-kvcp-seccon

kube-vip-cloud-provider: specify unprivileged securityContext
kube-vip · Nov 20, 2024 · 859474c · 859474c
2 parents a29bdc2 + 199b197
commit 859474c
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/charts/kube-vip-cloud-provider/Chart.yaml b/charts/kube-vip-cloud-provider/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.4
+version: 0.2.5
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

diff --git a/charts/kube-vip-cloud-provider/templates/deployment.yaml b/charts/kube-vip-cloud-provider/templates/deployment.yaml
@@ -29,6 +29,12 @@ spec:
             {{- toYaml .Values.resources | nindent 12 }}
           securityContext:
             allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            runAsNonRoot: true
+            runAsUser: 65532
+            runAsGroup: 65532
             seccompProfile:
               type: RuntimeDefault
       serviceAccountName: {{ include "kube-vip-cloud-provider.name" . }}