Merge pull request #136 from razo7/read-only-pod-fs

Limit Access to the pod's Root File System
medik8s · Dec 11, 2024 · 2bbe58f · 2bbe58f
2 parents 280dbc2 + 58dd50a
commit 2bbe58f
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/bundle/manifests/node-maintenance-operator.clusterserviceversion.yaml b/bundle/manifests/node-maintenance-operator.clusterserviceversion.yaml
@@ -283,6 +283,7 @@ spec:
                   capabilities:
                     drop:
                     - ALL
+                  readOnlyRootFilesystem: true
               priorityClassName: system-cluster-critical
               securityContext:
                 runAsNonRoot: true

diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
@@ -67,6 +67,7 @@ spec:
         name: manager
         securityContext:
           allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
           capabilities:
             drop:
             - "ALL"