Skip to content

Commit 6c485e6

Browse files
s-urbaniaks-urbaniak
committed
manifests/*: comply to restricted pod security level
1 parent ea4e749 commit 6c485e6

12 files changed

+117
-0
lines changed

‎manifests/0000_50_olm_06-psm-operator.deployment.ibm-cloud-managed.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,19 @@ spec:
2121
labels:
2222
app: package-server-manager
2323
spec:
24+
securityContext:
25+
runAsNonRoot: true
26+
runAsUser: 65534
27+
seccompProfile:
28+
type: RuntimeDefault
2429
serviceAccountName: olm-operator-serviceaccount
2530
priorityClassName: "system-cluster-critical"
2631
containers:
2732
- name: package-server-manager
33+
securityContext:
34+
allowPrivilegeEscalation: false
35+
capabilities:
36+
drop: ["ALL"]
2837
command:
2938
- /bin/psm
3039
- start

‎manifests/0000_50_olm_06-psm-operator.deployment.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,19 @@ spec:
2121
labels:
2222
app: package-server-manager
2323
spec:
24+
securityContext:
25+
runAsNonRoot: true
26+
runAsUser: 65534
27+
seccompProfile:
28+
type: RuntimeDefault
2429
serviceAccountName: olm-operator-serviceaccount
2530
priorityClassName: "system-cluster-critical"
2631
containers:
2732
- name: package-server-manager
33+
securityContext:
34+
allowPrivilegeEscalation: false
35+
capabilities:
36+
drop: ["ALL"]
2837
command:
2938
- /bin/psm
3039
- start

‎manifests/0000_50_olm_07-collect-profiles.cronjob.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,19 @@ spec:
1313
spec:
1414
template:
1515
spec:
16+
securityContext:
17+
runAsNonRoot: true
18+
runAsUser: 65534
19+
seccompProfile:
20+
type: RuntimeDefault
1621
serviceAccountName: collect-profiles
1722
priorityClassName: openshift-user-critical
1823
containers:
1924
- name: collect-profiles
25+
securityContext:
26+
allowPrivilegeEscalation: false
27+
capabilities:
28+
drop: ["ALL"]
2029
image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
2130
imagePullPolicy: IfNotPresent
2231
command:

‎manifests/0000_50_olm_07-olm-operator.deployment.ibm-cloud-managed.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@ spec:
2121
annotations:
2222
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
2323
spec:
24+
securityContext:
25+
runAsNonRoot: true
26+
runAsUser: 65534
27+
seccompProfile:
28+
type: RuntimeDefault
2429
serviceAccountName: olm-operator-serviceaccount
2530
volumes:
2631
- name: srv-cert
@@ -31,6 +36,10 @@ spec:
3136
secretName: pprof-cert
3237
containers:
3338
- name: olm-operator
39+
securityContext:
40+
allowPrivilegeEscalation: false
41+
capabilities:
42+
drop: ["ALL"]
3443
volumeMounts:
3544
- name: srv-cert
3645
mountPath: "/srv-cert"

‎manifests/0000_50_olm_07-olm-operator.deployment.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@ spec:
2121
annotations:
2222
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
2323
spec:
24+
securityContext:
25+
runAsNonRoot: true
26+
runAsUser: 65534
27+
seccompProfile:
28+
type: RuntimeDefault
2429
serviceAccountName: olm-operator-serviceaccount
2530
volumes:
2631
- name: srv-cert
@@ -31,6 +36,10 @@ spec:
3136
secretName: pprof-cert
3237
containers:
3338
- name: olm-operator
39+
securityContext:
40+
allowPrivilegeEscalation: false
41+
capabilities:
42+
drop: ["ALL"]
3443
volumeMounts:
3544
- name: srv-cert
3645
mountPath: "/srv-cert"

‎manifests/0000_50_olm_08-catalog-operator.deployment.ibm-cloud-managed.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@ spec:
2121
annotations:
2222
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
2323
spec:
24+
securityContext:
25+
runAsNonRoot: true
26+
runAsUser: 65534
27+
seccompProfile:
28+
type: RuntimeDefault
2429
serviceAccountName: olm-operator-serviceaccount
2530
volumes:
2631
- name: srv-cert
@@ -31,6 +36,10 @@ spec:
3136
secretName: pprof-cert
3237
containers:
3338
- name: catalog-operator
39+
securityContext:
40+
allowPrivilegeEscalation: false
41+
capabilities:
42+
drop: ["ALL"]
3443
volumeMounts:
3544
- name: srv-cert
3645
mountPath: "/srv-cert"

‎manifests/0000_50_olm_08-catalog-operator.deployment.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@ spec:
2121
annotations:
2222
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
2323
spec:
24+
securityContext:
25+
runAsNonRoot: true
26+
runAsUser: 65534
27+
seccompProfile:
28+
type: RuntimeDefault
2429
serviceAccountName: olm-operator-serviceaccount
2530
volumes:
2631
- name: srv-cert
@@ -31,6 +36,10 @@ spec:
3136
secretName: pprof-cert
3237
containers:
3338
- name: catalog-operator
39+
securityContext:
40+
allowPrivilegeEscalation: false
41+
capabilities:
42+
drop: ["ALL"]
3443
volumeMounts:
3544
- name: srv-cert
3645
mountPath: "/srv-cert"

‎pkg/manifests/csv.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,11 @@ spec:
8888
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
8989
creationTimestamp: null
9090
spec:
91+
securityContext:
92+
runAsNonRoot: true
93+
runAsUser: 65534
94+
seccompProfile:
95+
type: RuntimeDefault
9196
serviceAccountName: olm-operator-serviceaccount
9297
nodeSelector:
9398
kubernetes.io/os: linux
@@ -106,6 +111,10 @@ spec:
106111
tolerationSeconds: 120
107112
containers:
108113
- name: packageserver
114+
securityContext:
115+
allowPrivilegeEscalation: false
116+
capabilities:
117+
drop: ["ALL"]
109118
command:
110119
- /bin/package-server
111120
- -v=4

‎scripts/generate_crds_manifests.sh

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,10 +114,19 @@ spec:
114114
labels:
115115
app: package-server-manager
116116
spec:
117+
securityContext:
118+
runAsNonRoot: true
119+
runAsUser: 65534
120+
seccompProfile:
121+
type: RuntimeDefault
117122
serviceAccountName: olm-operator-serviceaccount
118123
priorityClassName: "system-cluster-critical"
119124
containers:
120125
- name: package-server-manager
126+
securityContext:
127+
allowPrivilegeEscalation: false
128+
capabilities:
129+
drop: ["ALL"]
121130
command:
122131
- /bin/psm
123132
- start
@@ -262,10 +271,19 @@ spec:
262271
spec:
263272
template:
264273
spec:
274+
securityContext:
275+
runAsNonRoot: true
276+
runAsUser: 65534
277+
seccompProfile:
278+
type: RuntimeDefault
265279
serviceAccountName: collect-profiles
266280
priorityClassName: openshift-user-critical
267281
containers:
268282
- name: collect-profiles
283+
securityContext:
284+
allowPrivilegeEscalation: false
285+
capabilities:
286+
drop: ["ALL"]
269287
image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
270288
imagePullPolicy: IfNotPresent
271289
command:

‎staging/operator-lifecycle-manager/deploy/chart/templates/0000_50_olm_07-olm-operator.deployment.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@ spec:
1717
labels:
1818
app: olm-operator
1919
spec:
20+
securityContext:
21+
runAsNonRoot: true
22+
runAsUser: 65534
23+
seccompProfile:
24+
type: RuntimeDefault
2025
serviceAccountName: olm-operator-serviceaccount
2126
{{- if or .Values.olm.tlsSecret .Values.olm.clientCASecret }}
2227
volumes:
@@ -33,6 +38,10 @@ spec:
3338
{{- end }}
3439
containers:
3540
- name: olm-operator
41+
securityContext:
42+
allowPrivilegeEscalation: false
43+
capabilities:
44+
drop: ["ALL"]
3645
{{- if or .Values.olm.tlsSecret .Values.olm.clientCASecret }}
3746
volumeMounts:
3847
{{- end }}

‎staging/operator-lifecycle-manager/deploy/chart/templates/0000_50_olm_08-catalog-operator.deployment.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@ spec:
1717
labels:
1818
app: catalog-operator
1919
spec:
20+
securityContext:
21+
runAsNonRoot: true
22+
runAsUser: 65534
23+
seccompProfile:
24+
type: RuntimeDefault
2025
serviceAccountName: olm-operator-serviceaccount
2126
{{- if or .Values.catalog.tlsSecret .Values.catalog.clientCASecret }}
2227
volumes:
@@ -33,6 +38,10 @@ spec:
3338
{{- end }}
3439
containers:
3540
- name: catalog-operator
41+
securityContext:
42+
allowPrivilegeEscalation: false
43+
capabilities:
44+
drop: ["ALL"]
3645
{{- if or .Values.catalog.tlsSecret .Values.catalog.clientCASecret }}
3746
volumeMounts:
3847
{{- end }}

‎staging/operator-lifecycle-manager/deploy/chart/templates/_packageserver.deployment-spec.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,11 @@ spec:
1414
labels:
1515
app: packageserver
1616
spec:
17+
securityContext:
18+
runAsNonRoot: true
19+
runAsUser: 65534
20+
seccompProfile:
21+
type: RuntimeDefault
1722
serviceAccountName: olm-operator-serviceaccount
1823
{{- if .Values.package.nodeSelector }}
1924
nodeSelector:
@@ -25,6 +30,10 @@ spec:
2530
{{- end }}
2631
containers:
2732
- name: packageserver
33+
securityContext:
34+
allowPrivilegeEscalation: false
35+
capabilities:
36+
drop: ["ALL"]
2837
command:
2938
- /bin/package-server
3039
- -v=4

0 commit comments

Comments
 (0)