update clustermanager and clusterproxy scc (#552)

Signed-off-by: Zhiwei Yin <[email protected]>
stolostron · Dec 8, 2023 · 7a26a7d · 7a26a7d
1 parent d7f963e
commit 7a26a7d
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 0 deletions.
diff --git a/pkg/templates/charts/toggle/cluster-manager/templates/cluster-manager.yaml b/pkg/templates/charts/toggle/cluster-manager/templates/cluster-manager.yaml
@@ -79,6 +79,13 @@ spec:
             - ALL
           privileged: false
           runAsNonRoot: true
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - name: tmpdir
+          mountPath: /tmp
+      volumes:
+        - name: tmpdir
+          emptyDir: { }
       hostIPC: false
       hostNetwork: false
       hostPID: false

diff --git a/pkg/templates/charts/toggle/cluster-proxy-addon/templates/manager-deployment.yaml b/pkg/templates/charts/toggle/cluster-proxy-addon/templates/manager-deployment.yaml
@@ -87,6 +87,14 @@ spec:
             - --agent-install-namespace=open-cluster-management-agent-addon
             - --agent-install-all=true
             - --enable-kube-api-proxy=false
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
+            runAsNonRoot: true
+            readOnlyRootFilesystem: true
         {{- if .Values.global.pullSecret }}
       imagePullSecrets:
       - name: {{ .Values.global.pullSecret }}

diff --git a/pkg/templates/charts/toggle/cluster-proxy-addon/templates/user-deployment.yaml b/pkg/templates/charts/toggle/cluster-proxy-addon/templates/user-deployment.yaml
@@ -87,6 +87,8 @@ spec:
             drop:
             - ALL
           privileged: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
       - name: user-server
         image: '{{ .Values.global.imageOverrides.cluster_proxy_addon }}'
         imagePullPolicy: '{{ .Values.global.pullPolicy }}'
@@ -119,6 +121,8 @@ spec:
             drop:
             - ALL
           privileged: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
         livenessProbe:
           httpGet:
             path: /healthz