Set seccomp profile to RuntimeDefault for calico-kube-controllers and…

… calico-typha (#6524)
projectcalico · Jun 21, 2024 · e11585c · e11585c
1 parent d3bc14c
commit e11585c
Show file tree

Hide file tree

Showing 13 changed files with 72 additions and 0 deletions.
diff --git a/charts/calico/templates/calico-kube-controllers.yaml b/charts/calico/templates/calico-kube-controllers.yaml
@@ -32,6 +32,9 @@ spec:
         - key: node-role.kubernetes.io/control-plane
           effect: NoSchedule
       serviceAccountName: calico-kube-controllers
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       priorityClassName: system-cluster-critical
 {{- if eq .Values.datastore "etcd" }}
       # The controllers must run in the host network namespace so that

diff --git a/charts/calico/templates/calico-node.yaml b/charts/calico/templates/calico-node.yaml
@@ -38,6 +38,9 @@ spec:
         - effect: NoExecute
           operator: Exists
       serviceAccountName: {{include "nodeName" . }}
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
       # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
       terminationGracePeriodSeconds: 0

diff --git a/charts/calico/templates/calico-typha.yaml b/charts/calico/templates/calico-typha.yaml
@@ -83,6 +83,8 @@ spec:
       # fsGroup allows using projected serviceaccount tokens as described here kubernetes/kubernetes#82573
       securityContext:
         fsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - image: {{ .Values.typha.image }}:{{.Values.version }}
         imagePullPolicy: {{.Values.imagePullPolicy}}

diff --git a/manifests/calico-bpf.yaml b/manifests/calico-bpf.yaml
diff --git a/manifests/calico-etcd.yaml b/manifests/calico-etcd.yaml
@@ -294,6 +294,9 @@ spec:
         - effect: NoExecute
           operator: Exists
       serviceAccountName: calico-node
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
       # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
       terminationGracePeriodSeconds: 0
@@ -611,6 +614,9 @@ spec:
         - key: node-role.kubernetes.io/control-plane
           effect: NoSchedule
       serviceAccountName: calico-kube-controllers
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       priorityClassName: system-cluster-critical
       # The controllers must run in the host network namespace so that
       # it isn't governed by policy that would prevent it from working.

diff --git a/manifests/calico-policy-only.yaml b/manifests/calico-policy-only.yaml
diff --git a/manifests/calico-typha.yaml b/manifests/calico-typha.yaml
diff --git a/manifests/calico-vxlan.yaml b/manifests/calico-vxlan.yaml
diff --git a/manifests/calico.yaml b/manifests/calico.yaml
diff --git a/manifests/canal-etcd.yaml b/manifests/canal-etcd.yaml
@@ -374,6 +374,9 @@ spec:
         - effect: NoExecute
           operator: Exists
       serviceAccountName: canal-node
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
       # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
       terminationGracePeriodSeconds: 0
@@ -771,6 +774,9 @@ spec:
         - key: node-role.kubernetes.io/control-plane
           effect: NoSchedule
       serviceAccountName: calico-kube-controllers
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       priorityClassName: system-cluster-critical
       # The controllers must run in the host network namespace so that
       # it isn't governed by policy that would prevent it from working.

diff --git a/manifests/canal.yaml b/manifests/canal.yaml
diff --git a/manifests/flannel-migration/calico.yaml b/manifests/flannel-migration/calico.yaml
diff --git a/node/tests/k8st/infra/calico-kdd.yaml b/node/tests/k8st/infra/calico-kdd.yaml
@@ -455,6 +455,9 @@ spec:
         - effect: NoExecute
           operator: Exists
       serviceAccountName: calico-node
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
       # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
       terminationGracePeriodSeconds: 0
@@ -778,6 +781,9 @@ spec:
         - key: node-role.kubernetes.io/control-plane
           effect: NoSchedule
       serviceAccountName: calico-kube-controllers
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       priorityClassName: system-cluster-critical
       containers:
         - name: calico-kube-controllers