Fix issues reported by kyverno policies (#126)

giantswarm · Aug 24, 2023 · 11f007a · 11f007a
1 parent 86f2547
commit 11f007a
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - Ignore CVE-2023-3978.
+- Fix security issues reported by kyverno policies.
 
 ## [0.8.0] - 2023-07-18
 

diff --git a/helm/dns-operator-route53/values.yaml b/helm/dns-operator-route53/values.yaml
@@ -32,10 +32,15 @@ staticBastionIP: ""
 
 # Add seccomp to pod security context
 podSecurityContext:
+  runAsNonRoot: true
   seccompProfile:
     type: RuntimeDefault
 
 # Add seccomp to container security context
 securityContext:
+  allowPrivilegeEscalation: false
   seccompProfile:
     type: RuntimeDefault
+  capabilities:
+    drop:
+      - ALL