Add securitycontext to kuberay operator (#408)

Based on ray-project/kuberay#1896
GoogleCloudPlatform · Mar 21, 2024 · 551c24a · 551c24a
1 parent 48d40e6
commit 551c24a
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 2 deletions.
diff --git a/modules/kuberay-operator/kuberay-operator-autopilot-values.yaml b/modules/kuberay-operator/kuberay-operator-autopilot-values.yaml
@@ -61,7 +61,13 @@ batchScheduler:
 
 # Set up `securityContext` to improve Pod security.
 # See https://github.com/ray-project/kuberay/blob/master/docs/guidance/pod-security.md for further guidance.
-securityContext: {}
+securityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+  capabilities:
+    drop:
+    - ALL
+  runAsNonRoot: true
 
 
 # If rbacEnable is set to false, no RBAC resources will be created, including the Role for leader election, the Role for Pods and Services, and so on.

diff --git a/modules/kuberay-operator/kuberay-operator-values.yaml b/modules/kuberay-operator/kuberay-operator-values.yaml
@@ -61,7 +61,13 @@ batchScheduler:
 
 # Set up `securityContext` to improve Pod security.
 # See https://github.com/ray-project/kuberay/blob/master/docs/guidance/pod-security.md for further guidance.
-securityContext: {}
+securityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+  capabilities:
+    drop:
+    - ALL
+  runAsNonRoot: true
 
 
 # If rbacEnable is set to false, no RBAC resources will be created, including the Role for leader election, the Role for Pods and Services, and so on.