added runAsNonRoot, dropped caps and disallow priv escalation

2026-01-13 16:20:23 +11:00
parent 9e2829f9bf
commit 3458bf91a3
1 changed files with 33 additions and 17 deletions
--- a/values.yaml
+++ b/values.yaml
@@ -263,9 +263,17 @@ injector:
    #    capabilities:
    #      drop:
    #        - ALL
+    #securityContext:
+    #  pod: {}
+    #  container: {}
    securityContext:
-    pod: {}
-    container: {}
+    pod:
+      runAsNonRoot: true
+    container:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL

  resources: {}
  # resources:
@@ -1031,9 +1039,17 @@ server:
    # If not set, these will default to, and for OpenShift:
    # pod: {}
    # container: {}
+    #securityContext:
+    #  pod: {}
+    #  container: {}
  securityContext:
-      pod: {}
-      container: {}
+    pod:
+      runAsNonRoot: true
+    container:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL

  # Should the server pods run on the host network
  hostNetwork: false