fix: Only add SC capabilities if vault templating is used (#218)

Signed-off-by: Ivaylo Ivanov <[email protected]>
bank-vaults · Jan 23, 2024 · 5c5715a · 5c5715a
1 parent dd5e627
commit 5c5715a
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 14 deletions.
diff --git a/pkg/webhook/pod.go b/pkg/webhook/pod.go
@@ -859,13 +859,7 @@ func getBaseSecurityContext(podSecurityContext *corev1.PodSecurityContext, vault
 		AllowPrivilegeEscalation: &vaultConfig.PspAllowPrivilegeEscalation,
 		ReadOnlyRootFilesystem:   &vaultConfig.ReadOnlyRootFilesystem,
 		Capabilities: &corev1.Capabilities{
-			Add: []corev1.Capability{
-				"CHOWN",
-				"SETFCAP",
-				"SETGID",
-				"SETPCAP",
-				"SETUID",
-			},
+			Add: []corev1.Capability{},
 			Drop: []corev1.Capability{
 				"ALL",
 			},

diff --git a/pkg/webhook/pod_test.go b/pkg/webhook/pod_test.go
@@ -514,13 +514,7 @@ func Test_mutatingWebhook_mutatePod(t *testing.T) {
 		ReadOnlyRootFilesystem:   &vaultConfig.ReadOnlyRootFilesystem,
 		AllowPrivilegeEscalation: &vaultConfig.PspAllowPrivilegeEscalation,
 		Capabilities: &corev1.Capabilities{
-			Add: []corev1.Capability{
-				"CHOWN",
-				"SETFCAP",
-				"SETGID",
-				"SETPCAP",
-				"SETUID",
-			},
+			Add: []corev1.Capability{},
 			Drop: []corev1.Capability{
 				"ALL",
 			},