RedXen/kubernetes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Drop anything but CHOWN

Browse Source
This commit is contained in:
Alex D. 2025-04-15 13:19:07 +00:00
parent bc116542c8
commit 3d5cff4b41
Signed by: caskd
GPG Key ID: F92BA85F61F4C173
13 changed files with 20 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
redxen/alloy/deployment.yml
View File

@ -32,7 +32,8 @@ spec:
imagePullPolicy: IfNotPresent
securityContext:
capabilities:
drop: ["SETPCAP", "MKNOD", "AUDIT_WRITE", "NET_RAW", "DAC_OVERRIDE", "FOWNER", "FSETID", "KILL", "SETGID", "SETUID", "NET_BIND_SERVICE", "SYS_CHROOT", "SETFCAP"]
drop: ["ALL"]
add: ["CHOWN"]
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false

3
redxen/gitea/deployment.yml
View File

@ -31,7 +31,8 @@ spec:
imagePullPolicy: IfNotPresent
securityContext:
capabilities:
drop: ["SETPCAP", "MKNOD", "AUDIT_WRITE", "NET_RAW", "DAC_OVERRIDE", "FOWNER", "FSETID", "KILL", "SETGID", "SETUID", "NET_BIND_SERVICE", "SYS_CHROOT", "SETFCAP"]
drop: ["ALL"]
add: ["CHOWN"]
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false

3
redxen/grafana/deployment.yml
View File

@ -31,7 +31,8 @@ spec:
imagePullPolicy: IfNotPresent
securityContext:
capabilities:
drop: ["SETPCAP", "MKNOD", "AUDIT_WRITE", "NET_RAW", "DAC_OVERRIDE", "FOWNER", "FSETID", "KILL", "SETGID", "SETUID", "NET_BIND_SERVICE", "SYS_CHROOT", "SETFCAP"]
drop: ["ALL"]
add: ["CHOWN"]
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false

4
redxen/haproxy/daemonset.yml
View File

@ -15,10 +15,6 @@ spec:
namespace: redxen
labels:
app: haproxy
annotations:
prometheus.io/scrape: 'true'
prometheus.io/path: '/metrics'
prometheus.io/port: '9100'
spec:
tolerations:
- key: node-role.kubernetes.io/control-plane

3
redxen/homepage/deployment.yml
View File

@ -31,7 +31,8 @@ spec:
imagePullPolicy: IfNotPresent
securityContext:
capabilities:
drop: ["SETPCAP", "MKNOD", "AUDIT_WRITE", "NET_RAW", "DAC_OVERRIDE", "FOWNER", "FSETID", "KILL", "SETGID", "SETUID", "NET_BIND_SERVICE", "SYS_CHROOT", "SETFCAP"]
drop: ["ALL"]
add: ["CHOWN"]
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false

1
redxen/kustomization.yaml
View File

@ -8,7 +8,6 @@ resources:
- haproxy/
- homepage/
- murmur/
- node_exporter/
- postgresql/
- redis/
- registry/

3
redxen/loki/deployment.yml
View File

@ -31,7 +31,8 @@ spec:
imagePullPolicy: IfNotPresent
securityContext:
capabilities:
drop: ["SETPCAP", "MKNOD", "AUDIT_WRITE", "NET_RAW", "DAC_OVERRIDE", "FOWNER", "FSETID", "KILL", "SETGID", "SETUID", "NET_BIND_SERVICE", "SYS_CHROOT", "SETFCAP"]
drop: ["ALL"]
add: ["CHOWN"]
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false

4
redxen/node_exporter/daemonset.yml
View File

@ -15,10 +15,6 @@ spec:
namespace: redxen
labels:
app: node-exporter
annotations:
prometheus.io/scrape: 'true'
prometheus.io/path: '/metrics'
prometheus.io/port: '9100'
spec:
# TODO: Figure out if node_exporter needs priviledged access
securityContext:

3
redxen/nsd/deployment.yml
View File

@ -38,7 +38,8 @@ spec:
imagePullPolicy: IfNotPresent
securityContext:
capabilities:
drop: ["SETPCAP", "MKNOD", "AUDIT_WRITE", "NET_RAW", "DAC_OVERRIDE", "FOWNER", "FSETID", "KILL", "SETGID", "SETUID", "NET_BIND_SERVICE", "SYS_CHROOT", "SETFCAP"]
drop: ["ALL"]
add: ["CHOWN"]
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false

3
redxen/postgresql/deployment.yml
View File

@ -31,7 +31,8 @@ spec:
imagePullPolicy: IfNotPresent
securityContext:
capabilities:
drop: ["SETPCAP", "MKNOD", "AUDIT_WRITE", "NET_RAW", "DAC_OVERRIDE", "FOWNER", "FSETID", "KILL", "SETGID", "SETUID", "NET_BIND_SERVICE", "SYS_CHROOT", "SETFCAP"]
drop: ["ALL"]
add: ["CHOWN"]
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false

3
redxen/prometheus/deployment.yml
View File

@ -32,7 +32,8 @@ spec:
imagePullPolicy: IfNotPresent
securityContext:
capabilities:
drop: ["SETPCAP", "MKNOD", "AUDIT_WRITE", "NET_RAW", "DAC_OVERRIDE", "FOWNER", "FSETID", "KILL", "SETGID", "SETUID", "NET_BIND_SERVICE", "SYS_CHROOT", "SETFCAP"]
drop: ["ALL"]
add: ["CHOWN"]
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false

3
redxen/redis/deployment.yml
View File

@ -31,7 +31,8 @@ spec:
imagePullPolicy: IfNotPresent
securityContext:
capabilities:
drop: ["SETPCAP", "MKNOD", "AUDIT_WRITE", "NET_RAW", "DAC_OVERRIDE", "FOWNER", "FSETID", "KILL", "SETGID", "SETUID", "NET_BIND_SERVICE", "SYS_CHROOT", "SETFCAP"]
drop: ["ALL"]
add: ["CHOWN"]
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false

3
redxen/registry/deployment.yml
View File

@ -31,7 +31,8 @@ spec:
imagePullPolicy: IfNotPresent
securityContext:
capabilities:
drop: ["SETPCAP", "MKNOD", "AUDIT_WRITE", "NET_RAW", "DAC_OVERRIDE", "FOWNER", "FSETID", "KILL", "SETGID", "SETUID", "NET_BIND_SERVICE", "SYS_CHROOT", "SETFCAP"]
drop: ["ALL"]
add: ["CHOWN"]
runAsUser: 0
runAsNonRoot: false
allowPrivilegeEscalation: false