Merge pull request #496 from KohlsTechnology/nonroot-helm-chart

Update Helm Chart to run as non-root
2026-01-25 20:59:28 +01:00 · 2021-02-18 00:34:51 -08:00
parent e56617253f 4444811f26
commit 477d12968e
1 changed files with 8 additions and 0 deletions
--- a/charts/descheduler/templates/cronjob.yaml
+++ b/charts/descheduler/templates/cronjob.yaml
@@ -59,6 +59,14 @@ spec:
                {{- end }}
              resources:
                {{- toYaml .Values.resources | nindent 16 }}
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - ALL
+                privileged: false
+                readOnlyRootFilesystem: true
+                runAsNonRoot: true
              volumeMounts:
                - mountPath: /policy-dir
                  name: policy-volume