feat: set allowPrivilegeEscalation: false and drop capabilities

steadybit · Aug 17, 2023 · f325590 · f325590
1 parent 8965aa5
commit f325590
Show file tree

Hide file tree

Showing 3 changed files with 33 additions and 1 deletion.
diff --git a/charts/steadybit-extension-scaffold/Chart.yaml b/charts/steadybit-extension-scaffold/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: steadybit-extension-scaffold
 description: Steadybit scaffold extension Helm chart for Kubernetes.
-version: 1.0.16
+version: 1.0.17
 appVersion: latest
 home: https://www.steadybit.com/
 icon: https://steadybit-website-assets.s3.amazonaws.com/logo-symbol-transparent.png

diff --git a/charts/steadybit-extension-scaffold/templates/deployment.yaml b/charts/steadybit-extension-scaffold/templates/deployment.yaml
@@ -64,6 +64,10 @@ spec:
             runAsNonRoot: true
             runAsUser: 10000
             runAsGroup: 10000
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
       volumes:
         {{- include "extensionlib.deployment.volumes" (list .) | nindent 8 }}
       serviceAccountName: {{ .Values.serviceAccount.name }}

diff --git a/charts/steadybit-extension-scaffold/tests/__snapshot__/deployment_test.yaml.snap b/charts/steadybit-extension-scaffold/tests/__snapshot__/deployment_test.yaml.snap
@@ -46,6 +46,10 @@ manifest should match snapshot using podAnnotations and Labels:
                   cpu: 50m
                   memory: 32Mi
               securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - ALL
                 readOnlyRootFilesystem: true
                 runAsGroup: 10000
                 runAsNonRoot: true
@@ -103,6 +107,10 @@ manifest should match snapshot with TLS:
                   cpu: 50m
                   memory: 32Mi
               securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - ALL
                 readOnlyRootFilesystem: true
                 runAsGroup: 10000
                 runAsNonRoot: true
@@ -170,6 +178,10 @@ manifest should match snapshot with extra env vars:
                   cpu: 50m
                   memory: 32Mi
               securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - ALL
                 readOnlyRootFilesystem: true
                 runAsGroup: 10000
                 runAsNonRoot: true
@@ -225,6 +237,10 @@ manifest should match snapshot with extra labels:
                   cpu: 50m
                   memory: 32Mi
               securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - ALL
                 readOnlyRootFilesystem: true
                 runAsGroup: 10000
                 runAsNonRoot: true
@@ -284,6 +300,10 @@ manifest should match snapshot with mutual TLS:
                   cpu: 50m
                   memory: 32Mi
               securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - ALL
                 readOnlyRootFilesystem: true
                 runAsGroup: 10000
                 runAsNonRoot: true
@@ -357,6 +377,10 @@ manifest should match snapshot with mutual TLS using containerPaths:
                   cpu: 50m
                   memory: 32Mi
               securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - ALL
                 readOnlyRootFilesystem: true
                 runAsGroup: 10000
                 runAsNonRoot: true
@@ -410,6 +434,10 @@ manifest should match snapshot without TLS:
                   cpu: 50m
                   memory: 32Mi
               securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - ALL
                 readOnlyRootFilesystem: true
                 runAsGroup: 10000
                 runAsNonRoot: true