More polex

giantswarm · Dec 20, 2024 · eebff0c · eebff0c
1 parent 45c1ae7
commit eebff0c
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 4 deletions.
diff --git a/helm/1password-scim-bridge/templates/kyverno-policy-exception.yaml b/helm/1password-scim-bridge/templates/kyverno-policy-exception.yaml
@@ -14,10 +14,22 @@ metadata:
     {{ include "onepassword-scim-bridge-helpers.labels" . | nindent 4 }}
 spec:
   exceptions:
+    - policyName: disallow-privileged-containers
+      ruleNames:
+      - autogen-privileged-containers
+      - privileged-containers
+    - policyName: disallow-privilege-escalation
+      ruleNames:
+      - autogen-privilege-escalation
+      - privilege-escalation
+    - policyName: require-run-as-non-root-user
+      ruleNames:
+      - autogen-run-as-non-root-user
+      - run-as-non-root-user
     - policyName: require-run-as-nonroot
       ruleNames:
-        - autogen-run-as-non-root
-        - run-as-non-root
+      - autogen-run-as-non-root
+      - run-as-non-root
   match:
     any:
       - resources:

diff --git a/helm/1password-scim-bridge/values.yaml b/helm/1password-scim-bridge/values.yaml
@@ -25,11 +25,11 @@ op-scim-bridge:
     imageRepository: quay.io/giantswarm/scim
 
     initContainerSecurityContext:
-      allowPrivilegeEscalation: false
+      allowPrivilegeEscalation: true
       capabilities:
         drop:
           - ALL
-      privileged: false
+      privileged: true
       readOnlyRootFilesystem: false
       runAsNonRoot: false
       seccompProfile:
@@ -49,6 +49,7 @@ op-scim-bridge:
         type: RuntimeDefault
 
     podSecurityContext:
+      fsGroup: 999
       runAsNonRoot: true
       seccompProfile:
         type: RuntimeDefault