webhook: set securityContext
To follow the least privilege principle, the conversion and admission webhooks
are run with a non-root user (uid = 2000).
Longhorn 3701
@@ -31,6 +31,8 @@ spec:
- name: longhorn-conversion-webhook
image: longhornio/longhorn-manager:master-head
imagePullPolicy: IfNotPresent
+ securityContext:
+ runAsUser: 2000
command:
- longhorn-manager
- conversion-webhook
@@ -92,11 +94,16 @@ spec:
initContainers:
- name: wait-longhorn-conversion-webhook
image: longhornio/longhorn-manager:master-head
+ imagePullPolicy: IfNotPresent
+ securityContext:
+ runAsUser: 2000
command: ['sh', '-c', 'while [ $(curl -m 1 -s -o /dev/null -w "%{http_code}" -k https://longhorn-conversion-webhook:9443/v1/healthz) != "200" ]; do echo waiting; sleep 2; done']
containers:
- name: longhorn-admission-webhook
image: longhornio/longhorn-manager:master-head
imagePullPolicy: IfNotPresent
+ securityContext:
+ runAsUser: 2000
command:
- longhorn-manager
- admission-webhook
