From 7f3747e6ef9f08e5ae465dd9f349543ca7187935 Mon Sep 17 00:00:00 2001
From: ston1th <ston1th@giftfish.de>
Date: Sat, 1 Feb 2020 17:35:13 +0100
Subject: [PATCH] added security context

---
 config/200-psp.yaml    | 2 +-
 config/deployment.yaml | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/config/200-psp.yaml b/config/200-psp.yaml
index 643277b..ba1057f 100644
--- a/config/200-psp.yaml
+++ b/config/200-psp.yaml
@@ -13,7 +13,7 @@ spec:
   allowPrivilegeEscalation: false
   requiredDropCapabilities: ["ALL"]
   readOnlyRootFilesystem: true
-  volumes: ["secret"]
+  volumes: ["configMap", "secret"]
   hostNetwork: false
   hostIPC: false
   hostPID: false
diff --git a/config/deployment.yaml b/config/deployment.yaml
index 32ec329..6767300 100644
--- a/config/deployment.yaml
+++ b/config/deployment.yaml
@@ -20,10 +20,15 @@ spec:
       containers:
       - name: webhook-interceptor
         image: git.giftfish.de/ston1th/webhook-interceptor
+        imagePullPolicy: Always
+        securityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
+          capabilities:
+            drop: ["ALL"]
         resources:
           requests:
             cpu: 100m
             memory: 128Mi
-        imagePullPolicy: Always
         ports:
         - containerPort: 8080