Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add ability to configure seccompProfile rbac-manager deployment helm chart values #500

Open
mkhodave opened this issue Nov 21, 2024 · 3 comments
Labels
enhancement Adding additional functionality or improvements good first issue Good for newcomers

Comments

@mkhodave
Copy link

When Kubernetes Pod Security Standards implemented as Kyverno policies on k8s cluster, rbac-manager shows policy failed in PolicyReport as following

  • category: Pod Security Standards (Restricted)
    message: 'validation error: Use of custom Seccomp profiles is disallowed. The fields
    spec.securityContext.seccompProfile.type, spec.containers[].securityContext.seccompProfile.type,
    spec.initContainers[
    ].securityContext.seccompProfile.type, and spec.ephemeralContainers[*].securityContext.seccompProfile.type
    must be set to RuntimeDefault or Localhost. rule autogen-check-seccomp-strict[0]
    failed at path /spec/template/spec/securityContext/seccompProfile/ rule autogen-check-seccomp-strict[1]
    failed at path /spec/template/spec/containers/0/securityContext/seccompProfile/'

Describe the solution you'd like
add ability to configure seccompProfile rbac-manager deployment helm chart values as its not available now in https://github.com/FairwindsOps/charts/blob/master/stable/rbac-manager/values.yaml#L56

Describe alternatives you've considered
NA

Additional context
NA

@mkhodave mkhodave added enhancement Adding additional functionality or improvements triage This bug needs triage labels Nov 21, 2024
@mkhodave
Copy link
Author

allowed values will be RuntimeDefault or Localhost

@sudermanjr
Copy link
Member

Please feel free to open a PR for this, thanks!

@sudermanjr sudermanjr added good first issue Good for newcomers and removed triage This bug needs triage labels Nov 21, 2024
@fadecore
Copy link

fadecore commented Dec 6, 2024

@mkhodave
You can just apply your own values file and add the missing piece you need.
Just use the following part and remember to use always the complete part of the securityContext, not just the part you want to add

# securityContext -- securityContext to apply to the rbac-manager container
securityContext:
  allowPrivilegeEscalation: false
  privileged: false
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  capabilities:
    drop:
      - ALL
  seccompProfile:
    type: RuntimeDefault

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement Adding additional functionality or improvements good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

3 participants