Merge pull request #495 from KohlsTechnology/nonroot

Update Job and CronJob YAML to run as non-root
2026-01-26 05:14:13 +01:00 · 2021-02-10 08:22:59 -08:00
parent fbd17d4caf dfc76906d4
commit b63c6fac27
2 changed files with 16 additions and 0 deletions
--- a/kubernetes/cronjob/cronjob.yaml
+++ b/kubernetes/cronjob/cronjob.yaml
@@ -31,6 +31,14 @@ spec:
              requests:
                cpu: "500m"
                memory: "256Mi"
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                  - ALL
+              privileged: false
+              readOnlyRootFilesystem: true
+              runAsNonRoot: true
          restartPolicy: "Never"
          serviceAccountName: descheduler-sa
          volumes:
--- a/kubernetes/job/job.yaml
+++ b/kubernetes/job/job.yaml
@@ -29,6 +29,14 @@ spec:
            requests:
              cpu: "500m"
              memory: "256Mi"
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
      restartPolicy: "Never"
      serviceAccountName: descheduler-sa
      volumes: