()
| 161 | } |
| 162 | |
| 163 | func getSecurityContext() *corev1.SecurityContext { |
| 164 | runAs := int64(10001) |
| 165 | sc := &corev1.SecurityContext{ |
| 166 | AllowPrivilegeEscalation: ptr.To(false), |
| 167 | RunAsNonRoot: ptr.To(true), |
| 168 | Capabilities: &corev1.Capabilities{ |
| 169 | Drop: []corev1.Capability{ |
| 170 | "ALL", |
| 171 | }, |
| 172 | }, |
| 173 | ReadOnlyRootFilesystem: ptr.To(true), |
| 174 | } |
| 175 | if utils.HaveSecurityContextConstraints() { |
| 176 | return sc |
| 177 | } |
| 178 | |
| 179 | sc.RunAsUser = &runAs |
| 180 | sc.RunAsGroup = &runAs |
| 181 | sc.SeccompProfile = &corev1.SeccompProfile{ |
| 182 | Type: corev1.SeccompProfileTypeRuntimeDefault, |
| 183 | } |
| 184 | |
| 185 | return sc |
| 186 | } |
| 187 | |
| 188 | func getPodSecurityContext() *corev1.PodSecurityContext { |
| 189 | if utils.HaveSecurityContextConstraints() { |
no test coverage detected