feat: Include the seccompProfile in default securityContext #138
Conversation
|
Nice, thank you! I think this should be backwards compatible for folks upgrading the chart. |
No, I can't think of any issue that would occur. In the most common case, this is a no-op (just explicitly defines what was already used); and in the worst case, someone's cluster was configured with a different default security context that was using a more permissive seccomp profile (eg. |
There was a problem hiding this comment.
Thanks @tstraley ! Would you mind bumping the chart version once more?
|
Nice one @tstraley that makes sense! |
To abide by the restricted Pod Security Standard, the seccompProfile type must be set in the securityContext to either RuntimeDefault or Localhost. https://kubernetes.io/docs/concepts/security/pod-security-standards/ Flipt runs fine with the RuntimeDefault profile as it doesn't require any special seccomp. Allows applying this helm chart out-of-the-box into a namespace that has restricted PSS enforcement enabled.
tstraley
force-pushed
the
restricted-security-context
branch
from
8b76dfe to
0854e8b
Compare
Rebased and bumped to 0.58.0! |
This change enabled deploying this helm chart, out-of-the-box, into a namespace
that has restricted PSS (pod security standards -- the replacement to PSP) enforcement enabled.
Read more about PSS here: https://kubernetes.io/docs/concepts/security/pod-security-standards/