Securitycontext

giantswarm · Dec 20, 2024 · b143c15 · b143c15
1 parent 00bcc3b
commit b143c15
Show file tree

Hide file tree

Showing 2 changed files with 43 additions and 3 deletions.
diff --git a/helm/1password-scim-bridge/charts/op-scim-bridge/templates/deployment.yaml b/helm/1password-scim-bridge/charts/op-scim-bridge/templates/deployment.yaml
@@ -45,6 +45,10 @@ spec:
       serviceAccountName: {{ tpl .Values.scim.name . }}
         {{- end }}
       {{- end }}
+      securityContext:
+        {{- with .Values.scim.podSecurityContext }}
+          {{- . | toYaml | nindent 8 }}
+        {{- end }}
       {{- with .Values.scim.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -79,16 +83,20 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- with .Values.scim.initContainerSecurityContext }}
+          securityContext:
+            {{- . | toYaml | nindent 12 }}
+          {{- end }}
       {{- end }}
       containers:
         - name: {{ tpl .Values.scim.name . }}
           image: {{ .Values.scim.imageRepository }}:{{ tpl .Values.scim.version . }}
           imagePullPolicy: {{ .Values.scim.imagePullPolicy }}
           command: ["/op-scim/op-scim"]
+          {{- with .Values.scim.containerSecurityContext }}
           securityContext:
-            runAsUser: 999
-            runAsGroup: 999
-            allowPrivilegeEscalation: false
+            {{- . | toYaml | nindent 12 }}
+          {{- end }}
           {{- with .Values.scim.imagePullSecrets }}
           imagePullSecrets:
             {{- toYaml . | nindent 12 }}

diff --git a/helm/1password-scim-bridge/values.yaml b/helm/1password-scim-bridge/values.yaml
@@ -1,3 +1,6 @@
+# The name of this App starts with a number, which K8s doesn't allow in Service names.
+# Fullname overrides are set for this chart and subcharts, but if that becomes a problem,
+# it might be better to rename the whole App.
 name: &name onepassword-scim-bridge
 
 project:
@@ -16,3 +19,32 @@ op-scim-bridge:
   scim:
     name: *name
     imageRepository: quay.io/giantswarm/scim
+
+    initContainerSecurityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      seccompProfile:
+        type: RuntimeDefault
+
+    containerSecurityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      seccompProfile:
+        type: RuntimeDefault
+
+    podSecurityContext:
+      runAsUser: 999
+      runAsGroup: 999
+      runAsNonRoot: true
+      seccompProfile:
+        type: RuntimeDefault