Run preinstall job as non-root (#14)

* Run preinstall job as non-root
giantswarm · Oct 10, 2023 · 31709d3 · 31709d3
1 parent f47185a
commit 31709d3
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Run preinstall job as non-root.
+
 ## [0.0.1] - 2023-10-05
 
 - First release of the Kyverno Policy Operator App. 

diff --git a/helm/kyverno-policy-operator/templates/crd-install/crd-job.yaml b/helm/kyverno-policy-operator/templates/crd-install/crd-job.yaml
@@ -23,6 +23,7 @@ spec:
       securityContext:
         seccompProfile:
           type: RuntimeDefault
+        runAsNonRoot: true
         runAsUser: 65534
         runAsGroup: 65534
       tolerations:
@@ -44,8 +45,14 @@ spec:
           seccompProfile:
             type: RuntimeDefault
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+          privileged: false
+          runAsNonRoot: true
           runAsUser: 65534
           runAsGroup: 65534
+          capabilities:
+            drop:
+            - ALL
         volumeMounts:
 {{- range $path, $_ := .Files.Glob "crd/**" }}
         - name: {{ $path | base | trimSuffix ".yaml" }}