Update Helm Chart to run as non-root

2026-01-26 05:14:13 +01:00 · 2021-02-10 21:49:01 -06:00
parent b63c6fac27
commit 4444811f26
1 changed files with 8 additions and 0 deletions
--- a/charts/descheduler/templates/cronjob.yaml
+++ b/charts/descheduler/templates/cronjob.yaml
@@ -59,6 +59,14 @@ spec:
                {{- end }}
              resources:
                {{- toYaml .Values.resources | nindent 16 }}
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - ALL
+                privileged: false
+                readOnlyRootFilesystem: true
+                runAsNonRoot: true
              volumeMounts:
                - mountPath: /policy-dir
                  name: policy-volume