security context - drop all capabilities

part of kiali/kiali#5399
kiali · Aug 24, 2022 · 66ac9cb · 66ac9cb
1 parent 473f150
commit 66ac9cb
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 0 deletions.
diff --git a/manifests/kiali-ossm/manifests/kiali.clusterserviceversion.yaml b/manifests/kiali-ossm/manifests/kiali.clusterserviceversion.yaml
@@ -241,6 +241,9 @@ spec:
                   allowPrivilegeEscalation: false
                   privileged: false
                   runAsNonRoot: true
+                  capabilities:
+                    drop:
+                    - ALL
                 volumeMounts:
                 - mountPath: /tmp/ansible-operator/runner
                   name: runner

diff --git a/roles/default/kiali-deploy/templates/kubernetes/deployment.yaml b/roles/default/kiali-deploy/templates/kubernetes/deployment.yaml
@@ -60,6 +60,9 @@ spec:
           privileged: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
+          capabilities:
+            drop:
+            - ALL
         ports:
           - name: api-port
             containerPort: {{ kiali_vars.server.port }}

diff --git a/roles/default/kiali-deploy/templates/openshift/deployment.yaml b/roles/default/kiali-deploy/templates/openshift/deployment.yaml
@@ -60,6 +60,9 @@ spec:
           privileged: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
+          capabilities:
+            drop:
+            - ALL
         ports:
           - name: api-port
             containerPort: {{ kiali_vars.server.port }}