fix: executor database privileges

InseeFr · Jun 6, 2024 · e1c4dc9 · e1c4dc9
1 parent bf2cc30
commit e1c4dc9
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/.../fr/insee/arc/core/service/kubernetes/configuration/ExecutorDatabaseStatefulTemplate.java b/.../fr/insee/arc/core/service/kubernetes/configuration/ExecutorDatabaseStatefulTemplate.java
@@ -150,7 +150,16 @@ private ExecutorDatabaseStatefulTemplate() {
               }
             },
             "securityContext": {
-              "runAsUser": 0
+              "runAsNonRoot": true,
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "seccompProfile": {
+                "type": "RuntimeDefault"
+              }
             },
             "terminationMessagePath": "/dev/termination-log",
             "terminationMessagePolicy": "File",