From 0374a55eb3bbcc5199a254878bd5e1668abd9dcf Mon Sep 17 00:00:00 2001
From: Kenichi Omichi <ken1ohmichi@gmail.com>
Date: Thu, 20 Oct 2022 16:57:08 +0900
Subject: [PATCH] Specify securityContext for cert-manager (#9404)
On hardening environments, cert-manager pods could not be created
from the corresponding deployments. This adds the securityContext
to solve the issue.
---
.../cert_manager/templates/cert-manager.yml.j2 | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.yml.j2 b/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.yml.j2
index 6ac4f0b8f..39fad4f9a 100644
--- a/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.yml.j2
+++ b/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.yml.j2
@@ -870,6 +870,11 @@ spec:
fieldPath: metadata.namespace
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ drop: ['ALL']
+ runAsNonRoot: true
+ seccompProfile:
+ type: RuntimeDefault
{% if cert_manager_tolerations %}
tolerations:
{{ cert_manager_tolerations | to_nice_yaml(indent=2) | indent(width=8) }}
@@ -944,6 +949,11 @@ spec:
protocol: TCP
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ drop: ['ALL']
+ runAsNonRoot: true
+ seccompProfile:
+ type: RuntimeDefault
env:
- name: POD_NAMESPACE
valueFrom:
@@ -1040,6 +1050,11 @@ spec:
failureThreshold: 3
securityContext:
allowPrivilegeEscalation: false
+ capabilities:
+ drop: ['ALL']
+ runAsNonRoot: true
+ seccompProfile:
+ type: RuntimeDefault
env:
- name: POD_NAMESPACE
valueFrom:
--
GitLab