Apply trivy recommended hardening

Signed-off-by: Pat Riehecky <[email protected]>
rancher · Jul 18, 2023 · ba8b940 · ba8b940
1 parent 4d42c70
commit ba8b940
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 0 deletions.
diff --git a/deploy/chart/local-path-provisioner/templates/deployment.yaml b/deploy/chart/local-path-provisioner/templates/deployment.yaml
@@ -74,6 +74,9 @@ spec:
           env:
             - name: POD_NAMESPACE
               value: {{ .Release.Namespace }}
+          {{- with .Values.containerSecurityContext }}
+          securityContext: {{ toYaml .| nindent 12 }}
+          {{- end }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       volumes:

diff --git a/deploy/chart/local-path-provisioner/values.yaml b/deploy/chart/local-path-provisioner/values.yaml
@@ -23,6 +23,11 @@ imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
+podSecurityContext: {}
+containerSecurityContext:
+  seccompProfile:
+    type: RuntimeDefault
+
 ## For creating the StorageClass automatically:
 storageClass:
   create: true

diff --git a/deploy/local-path-storage.yaml b/deploy/local-path-storage.yaml
@@ -78,6 +78,9 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
+          securityContext:
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: config-volume
           configMap:

diff --git a/deploy/provisioner.yaml b/deploy/provisioner.yaml
@@ -32,6 +32,9 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
+          securityContext:
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: config-volume
           configMap: