From 81c33aeaa0163f6bcf7edf21710e34b0ad3acc7f Mon Sep 17 00:00:00 2001
From: Yannik Schmidt <yannik.schmidt.extern@univention.de>
Date: Tue, 20 May 2025 07:30:17 +0200
Subject: [PATCH] fix: security kontext kc proxy

---
 helmfile/apps/nubus/values-nubus.yaml.gotmpl | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/helmfile/apps/nubus/values-nubus.yaml.gotmpl b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
index 7d7a010e..cfe49a7e 100644
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -700,6 +700,17 @@ nubusKeycloakExtensions:
     resources:
       {{ .Values.resources.umsKeycloakExtensionProxy | toYaml | nindent 6 }}
     securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - "ALL"
+      enabled: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      seccompProfile:
+        type: "RuntimeDefault"
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
       seccompProfile:
         type: "RuntimeDefault"
       seLinuxOptions: