mirror of
https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git
synced 2025-12-08 00:11:38 +01:00
fix(oxconnector): Update to strict securityContext from upstream defaults
This commit is contained in:
@@ -73,29 +73,21 @@ podAnnotations: {}
|
|||||||
|
|
||||||
replicaCount: {{ .Values.replicas.oxConnector }}
|
replicaCount: {{ .Values.replicas.oxConnector }}
|
||||||
|
|
||||||
|
podSecurityContext:
|
||||||
|
fsGroup: 1000
|
||||||
|
|
||||||
securityContext:
|
securityContext:
|
||||||
|
privileged: false
|
||||||
allowPrivilegeEscalation: false
|
allowPrivilegeEscalation: false
|
||||||
capabilities:
|
capabilities:
|
||||||
drop:
|
drop:
|
||||||
- "ALL"
|
- "ALL"
|
||||||
add:
|
readOnlyRootFilesystem: true
|
||||||
- "CHOWN"
|
runAsNonRoot: true
|
||||||
- "DAC_OVERRIDE"
|
runAsUser: 1000
|
||||||
- "FOWNER"
|
runAsGroup: 1000
|
||||||
- "FSETID"
|
|
||||||
- "KILL"
|
|
||||||
- "SETGID"
|
|
||||||
- "SETUID"
|
|
||||||
- "SETPCAP"
|
|
||||||
- "NET_BIND_SERVICE"
|
|
||||||
- "SYS_CHROOT"
|
|
||||||
privileged: false
|
|
||||||
seccompProfile:
|
seccompProfile:
|
||||||
type: "RuntimeDefault"
|
type: "RuntimeDefault"
|
||||||
runAsUser: 0
|
|
||||||
runAsGroup: 0
|
|
||||||
runAsNonRoot: false
|
|
||||||
readOnlyRootFilesystem: false
|
|
||||||
seLinuxOptions:
|
seLinuxOptions:
|
||||||
{{ .Values.seLinuxOptions.oxConnector | toYaml | nindent 4 }}
|
{{ .Values.seLinuxOptions.oxConnector | toYaml | nindent 4 }}
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user