Merge pull request #63 from sebastiangaiser/feature/add-default-secur…

…ity-context feat(chart): add default security context
sebastiangaiser · Jan 16, 2025 · d4fe24f · d4fe24f
2 parents 2b8307b + c7cafa1
commit d4fe24f
Showing 1 changed file with 15 additions and 3 deletions.
diff --git a/chart/templates/deployment.yaml b/chart/templates/deployment.yaml
@@ -15,10 +15,10 @@ spec:
       labels:
         {{- include "ca-controller-for-strimzi.selectorLabels" . | nindent 8 }}
     spec:
-    {{- with .Values.imagePullSecrets }}
+      {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
-      {{- toYaml . | nindent 8 }}
-    {{- end }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       serviceAccountName: {{ include "ca-controller-for-strimzi.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
@@ -43,8 +43,20 @@ spec:
               port: 8081
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+          {{- if .Values.securityContext }}
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
+          {{- else }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault
+          {{- end }}
           volumeMounts:
             {{- range $name, $spec := $.Values.volumes }}
             - name: {{ $name }}