Restrict Flux's PSP
prevent Flux from running as privileged container
@@ -8,12 +8,19 @@ metadata:
chart: {{ include "flux.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
+ annotations:
+ seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
spec:
+ privileged: false
+ hostIPC: false
+ hostNetwork: false
+ hostPID: false
+ readOnlyRootFilesystem: false
+ allowPrivilegeEscalation: true
allowedCapabilities:
- '*'
fsGroup:
rule: RunAsAny
- privileged: true
runAsUser:
rule: RunAsAny
seLinux:
@@ -22,10 +29,4 @@ spec:
rule: RunAsAny
volumes:
- '*'
- hostPID: true
- hostIPC: true
- hostNetwork: true
- hostPorts:
- - min: 1
- max: 65536
{{- end }}
