Add securityContexts

preparingforexams · Dec 27, 2024 · afe97b7 · afe97b7
1 parent 7018feb
commit afe97b7
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/chart/templates/crons.yaml b/chart/templates/crons.yaml
@@ -18,6 +18,10 @@ spec:
       template:
         spec:
           restartPolicy: Never
+          securityContext:
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault
           containers:
             - name: app
               image: {{ $.Values.image.app }}:{{ $.Values.appVersion }}
@@ -29,6 +33,10 @@ spec:
                 requests:
                   cpu: 1000m
                   memory: 128Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop: [ ALL ]
               env:
                 - name: DATABASE_PASSWORD
                   valueFrom:

diff --git a/chart/templates/sts-update-handler.yaml b/chart/templates/sts-update-handler.yaml
@@ -23,9 +23,17 @@ spec:
       labels:
         app: {{ .Release.Name }}-update-handler
     spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+        runAsNonRoot: true
       initContainers:
         - name: flyway
           image: {{ .Values.image.migrations }}:{{ .Values.appVersion }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ ALL ]
           envFrom:
             - configMapRef:
                 name: {{ .Release.Name }}-db
@@ -50,6 +58,10 @@ spec:
             requests:
               cpu: 10m
               memory: 128Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ ALL ]
           env:
             - name: DATABASE_PASSWORD
               valueFrom: