updated security policies

mintel · Jul 26, 2023 · e8b5425 · e8b5425
1 parent 840a4b0
commit e8b5425
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 0 deletions.
diff --git a/charts/standard-application-stack/templates/mariadb-py-dba.yaml b/charts/standard-application-stack/templates/mariadb-py-dba.yaml
@@ -21,6 +21,7 @@ spec:
       {{- include "mintel_common.imagePullSecrets" $ | nindent 6 }}
       securityContext:
         runAsUser: 1000
+        runAsNonRoot: true
       serviceAccountName: {{ $.Values.serviceAccount.name | default (include "mintel_common.fullname" $)}}
       restartPolicy: "Never"
       containers:
@@ -44,6 +45,13 @@ spec:
           requests:
             cpu: 100m
             memory: 32Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          runAsNonRoot: true
+          runAsUser: 1000
         volumeMounts:
         - name: config-volume
           mountPath: /etc/config

diff --git a/charts/standard-application-stack/tests/__snapshot__/mariadb_py_dba_test.yaml.snap b/charts/standard-application-stack/tests/__snapshot__/mariadb_py_dba_test.yaml.snap
@@ -39,6 +39,13 @@ adds correct config to configmap:
                 requests:
                   cpu: 100m
                   memory: 32Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - ALL
+                runAsNonRoot: true
+                runAsUser: 1000
               volumeMounts:
                 - mountPath: /etc/config
                   name: config-volume
@@ -47,6 +54,7 @@ adds correct config to configmap:
             - name: image-pull-docker-hub
           restartPolicy: Never
           securityContext:
+            runAsNonRoot: true
             runAsUser: 1000
           serviceAccountName: test-app
           volumes:
@@ -119,6 +127,13 @@ extraUsers adds job and configmap:
                 requests:
                   cpu: 100m
                   memory: 32Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - ALL
+                runAsNonRoot: true
+                runAsUser: 1000
               volumeMounts:
                 - mountPath: /etc/config
                   name: config-volume
@@ -127,6 +142,7 @@ extraUsers adds job and configmap:
             - name: image-pull-docker-hub
           restartPolicy: Never
           securityContext:
+            runAsNonRoot: true
             runAsUser: 1000
           serviceAccountName: test-app
           volumes: