Fix issues reported by kyverno policies (#35)

giantswarm · Aug 24, 2023 · b95b212 · b95b212
1 parent 13ab0b4
commit b95b212
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - Ignore CVE-2023-3978 & CVE-2023-29401.
+- Fix security issues reported by kyverno policies.
 
 ## [0.1.0] - 2023-05-09
 

diff --git a/helm/cluster-api-cleaner-vsphere/values.yaml b/helm/cluster-api-cleaner-vsphere/values.yaml
@@ -17,10 +17,15 @@ pod:
 
 # Add seccomp to pod security context
 podSecurityContext:
+  runAsNonRoot: true
   seccompProfile:
     type: RuntimeDefault
 
 # Add seccomp to container security context
 securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
   seccompProfile:
     type: RuntimeDefault