ston1th/webhook-interceptor
0
0
Fork 0
Code Issues Pull requests Releases Activity

added security context

Browse source
This commit is contained in:
ston1th 2020-02-01 17:35:13 +01:00
commit 7f3747e6ef
2 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
config/200-psp.yaml
View file

@ -13,7 +13,7 @@ spec:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
requiredDropCapabilities: ["ALL"] requiredDropCapabilities: ["ALL"]
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
volumes: ["secret"] volumes: ["configMap", "secret"]
hostNetwork: false hostNetwork: false
hostIPC: false hostIPC: false
hostPID: false hostPID: false

7
config/deployment.yaml
View file

@ -20,10 +20,15 @@ spec:
containers: containers:
- name: webhook-interceptor - name: webhook-interceptor
image: git.giftfish.de/ston1th/webhook-interceptor image: git.giftfish.de/ston1th/webhook-interceptor
imagePullPolicy: Always
securityContext:
runAsUser: 1000
runAsGroup: 1000
capabilities:
drop: ["ALL"]
resources: resources:
requests: requests:
cpu: 100m cpu: 100m
memory: 128Mi memory: 128Mi
imagePullPolicy: Always
ports: ports:
- containerPort: 8080 - containerPort: 8080