Skip to content

Commit 9e2542c

Browse files
authored
Add Seccomp profile to deployment (#446)
**Description of changes:** I have recently tried to leveraging k8s built in [Enforce Pod Security Standards with Namespace Labels](https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels/) feature. When I tried to install one of the controllers I noticed warnings on the [restricted]( https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) profile. This I found strange because I checked beforehand and I saw you were already dropping all the capabilities: https://github.com/aws-controllers-k8s/code-generator/blob/811e30bb8efe2855f79e6e946039247e23c0d03b/templates/helm/templates/deployment.yaml#L112-L118 And hard setting the host env: https://github.com/aws-controllers-k8s/code-generator/blob/811e30bb8efe2855f79e6e946039247e23c0d03b/templates/helm/templates/deployment.yaml#L130-L132 It looks like it's just missing the scomp profile! *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.*
1 parent 811e30b commit 9e2542c

File tree

3 files changed

+7
-1
lines changed

3 files changed

+7
-1
lines changed

templates/config/controller/deployment.yaml.tpl

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,9 @@ spec:
7373
capabilities:
7474
drop:
7575
- ALL
76+
securityContext:
77+
seccompProfile:
78+
type: RuntimeDefault
7679
terminationGracePeriodSeconds: 10
7780
serviceAccountName: {{ .ServiceAccountName }}
7881
hostIPC: false

templates/helm/templates/deployment.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,9 @@ spec:
116116
capabilities:
117117
drop:
118118
- ALL
119+
securityContext:
120+
seccompProfile:
121+
type: RuntimeDefault
119122
terminationGracePeriodSeconds: 10
120123
nodeSelector: {{ toYaml .Values.deployment.nodeSelector | nindent 8 }}
121124
{{ if .Values.deployment.tolerations -}}

templates/helm/values.yaml.tpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ deployment:
3131

3232
# If "installScope: cluster" then these labels will be applied to ClusterRole
3333
role:
34-
labels: {}
34+
labels: {}
3535

3636
metrics:
3737
service:

0 commit comments

Comments
 (0)