Add parameters for PodSecurity restricted

Signed-off-by: Pat Riehecky <riehecky@fnal.gov>
2023-04-05 15:53:05 -05:00 · 2023-04-05 15:53:05 -05:00 · b23f04078c
parent 4efc9d1f86
commit b23f04078c
5 changed files with 14 additions and 0 deletions
--- a/examples/autosharding/statefulset.yaml
+++ b/examples/autosharding/statefulset.yaml
@ -59,7 +59,10 @@ spec:
            drop:
            - ALL
          readOnlyRootFilesystem: true
+          runAsNonRoot: true
          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: kube-state-metrics
--- a/examples/daemonsetsharding/daemonset.yaml
+++ b/examples/daemonsetsharding/daemonset.yaml
@ -54,7 +54,10 @@ spec:
            drop:
            - ALL
          readOnlyRootFilesystem: true
+          runAsNonRoot: true
          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: kube-state-metrics
--- a/examples/daemonsetsharding/deployment.yaml
+++ b/examples/daemonsetsharding/deployment.yaml
@ -48,7 +48,10 @@ spec:
            drop:
            - ALL
          readOnlyRootFilesystem: true
+          runAsNonRoot: true
          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: kube-state-metrics
--- a/examples/standard/deployment.yaml
+++ b/examples/standard/deployment.yaml
@ -46,7 +46,10 @@ spec:
            drop:
            - ALL
          readOnlyRootFilesystem: true
+          runAsNonRoot: true
          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: kube-state-metrics
--- a/jsonnet/kube-state-metrics/kube-state-metrics.libsonnet
+++ b/jsonnet/kube-state-metrics/kube-state-metrics.libsonnet
@ -185,9 +185,11 @@
      ],
      securityContext: {
        runAsUser: 65534,
+        runAsNonRoot: true,
        allowPrivilegeEscalation: false,
        readOnlyRootFilesystem: true,
        capabilities: { drop: ['ALL'] },
+        seccompProfile: { type: 'RuntimeDefault' },
      },
      livenessProbe: { timeoutSeconds: 5, initialDelaySeconds: 5, httpGet: {
        port: 8080,