You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When Kubernetes Pod Security Standards implemented as Kyverno policies on k8s cluster, rbac-manager shows policy failed in PolicyReport as following
category: Pod Security Standards (Restricted)
message: 'validation error: Use of custom Seccomp profiles is disallowed. The fields
spec.securityContext.seccompProfile.type, spec.containers[].securityContext.seccompProfile.type,
spec.initContainers[].securityContext.seccompProfile.type, and spec.ephemeralContainers[*].securityContext.seccompProfile.type
must be set to RuntimeDefault or Localhost. rule autogen-check-seccomp-strict[0]
failed at path /spec/template/spec/securityContext/seccompProfile/ rule autogen-check-seccomp-strict[1]
failed at path /spec/template/spec/containers/0/securityContext/seccompProfile/'
@mkhodave
You can just apply your own values file and add the missing piece you need.
Just use the following part and remember to use always the complete part of the securityContext, not just the part you want to add
# securityContext -- securityContext to apply to the rbac-manager containersecurityContext:
allowPrivilegeEscalation: falseprivileged: falsereadOnlyRootFilesystem: truerunAsNonRoot: truecapabilities:
drop:
- ALLseccompProfile:
type: RuntimeDefault
When Kubernetes Pod Security Standards implemented as Kyverno policies on k8s cluster, rbac-manager shows policy failed in PolicyReport as following
message: 'validation error: Use of custom Seccomp profiles is disallowed. The fields
spec.securityContext.seccompProfile.type, spec.containers[].securityContext.seccompProfile.type,
spec.initContainers[].securityContext.seccompProfile.type, and spec.ephemeralContainers[*].securityContext.seccompProfile.type
must be set to
RuntimeDefault
orLocalhost
. rule autogen-check-seccomp-strict[0]failed at path /spec/template/spec/securityContext/seccompProfile/ rule autogen-check-seccomp-strict[1]
failed at path /spec/template/spec/containers/0/securityContext/seccompProfile/'
Describe the solution you'd like
add ability to configure seccompProfile rbac-manager deployment helm chart values as its not available now in https://github.com/FairwindsOps/charts/blob/master/stable/rbac-manager/values.yaml#L56
Describe alternatives you've considered
NA
Additional context
NA
The text was updated successfully, but these errors were encountered: