Function RestrictedSecurityContext

internal/initialize/security.go:23–48

RestrictedSecurityContext returns a v1.SecurityContext with safe defaults. See https://docs.k8s.io/concepts/security/pod-security-standards/

()

// RestrictedSecurityContext returns a v1.SecurityContext with safe defaults.
// See https://docs.k8s.io/concepts/security/pod-security-standards/
func RestrictedSecurityContext() *corev1.SecurityContext {
	return &corev1.SecurityContext{
		// Prevent any container processes from gaining privileges.
		AllowPrivilegeEscalation: Bool(false),

		// Drop any capabilities granted by the container runtime.
		// This must be uppercase to pass Pod Security Admission.
		// - https://releases.k8s.io/v1.24.0/staging/src/k8s.io/pod-security-admission/policy/check_capabilities_restricted.go
		Capabilities: &corev1.Capabilities{
			Drop: []corev1.Capability{"ALL"},
		},

		// Processes in privileged containers are essentially root on the host.
		Privileged: Bool(false),

		// Limit filesystem changes to volumes that are mounted read-write.
		ReadOnlyRootFilesystem: Bool(true),

		// Fail to start the container if its image runs as UID 0 (root).
		RunAsNonRoot: Bool(true),

		SeccompProfile: &corev1.SeccompProfile{
			Type: corev1.SeccompProfileTypeRuntimeDefault,
		},
	}
}