Skip to content

set cluster-operator securitycontext #1960

@3deep5me

Description

@3deep5me

Is your feature request related to a problem? Please describe.
The current deployment of the operator is not Pod Security Standards:restricted compatible.
Which is why i get this error

  Warning  FailedCreate  5m1s (x8 over 10m)  replicaset-controller  (combined from similar events): Error creating: pods "rabbitmq-cluster-operator-6b5b87cdc6-vr96l" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "operator" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "operator" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "operator" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "operator" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

Describe the solution you'd like
Setting the security context to this:

    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      runAsUser: 1001
      seccompProfile:
        type: RuntimeDefault

Describe alternatives you've considered
I patched it manually - but i think it would be also nice to have it in the upstream.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions