operator: Adapt to k8s-1.25 security restrictions
@@ -128,6 +128,7 @@ func NewRelatedImage(image string) RelatedImage {
func GetDeployment(version string, operatorVersion string, namespace string, repository string, imageName string, tag string, imagePullPolicy string, addonsImages *AddonsImages) *appsv1.Deployment {
image := fmt.Sprintf("%s/%s:%s", repository, imageName, tag)
runAsNonRoot := true
+ allowPrivilegeEscalation := false
deployment := &appsv1.Deployment{
TypeMeta: metav1.TypeMeta{
@@ -168,6 +169,9 @@ func GetDeployment(version string, operatorVersion string, namespace string, rep
ServiceAccountName: Name,
SecurityContext: &corev1.PodSecurityContext{
RunAsNonRoot: &runAsNonRoot,
+ SeccompProfile: &corev1.SeccompProfile{
+ Type: corev1.SeccompProfileTypeRuntimeDefault,
+ },
},
PriorityClassName: "system-cluster-critical",
Containers: []corev1.Container{
@@ -263,6 +267,12 @@ func GetDeployment(version string, operatorVersion string, namespace string, rep
Value: "prometheus-k8s",
},
},
+ SecurityContext: &corev1.SecurityContext{
+ AllowPrivilegeEscalation: &allowPrivilegeEscalation,
+ Capabilities: &corev1.Capabilities{
+ Drop: []corev1.Capability{corev1.Capability("ALL")},
+ },
+ },
},
{
Name: "kube-rbac-proxy",
@@ -287,6 +297,12 @@ func GetDeployment(version string, operatorVersion string, namespace string, rep
},
},
TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
+ SecurityContext: &corev1.SecurityContext{
+ AllowPrivilegeEscalation: &allowPrivilegeEscalation,
+ Capabilities: &corev1.Capabilities{
+ Drop: []corev1.Capability{corev1.Capability("ALL")},
+ },
+ },
},
},
},
