Fix PSS restricted warnings (#2528)

* fix pss warnings Signed-off-by: Harshvir Potpose <[email protected]> * fix mysql Signed-off-by: Harshvir Potpose <[email protected]> --------- Signed-off-by: Harshvir Potpose <[email protected]>
2026-09-24 00:31:27 +00:00 · 2025-04-29 16:33:02 +00:00
parent c231218c66
commit e528adf086
4 changed files with 40 additions and 0 deletions
@@ -58,6 +58,15 @@ spec:
              name: katib-config
              subPath: katib-config.yaml
              readOnly: true
+          securityContext:
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
+            capabilities:
+              drop:
+              - ALL
      volumes:
        - name: cert
          secret:
@@ -40,3 +40,12 @@ spec:
            initialDelaySeconds: 10
            periodSeconds: 60
            failureThreshold: 5
+          securityContext:
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
+            capabilities:
+              drop:
+              - ALL
@@ -20,6 +20,9 @@ spec:
      annotations:
        sidecar.istio.io/inject: "false"
    spec:
+      securityContext:
+        fsGroup: 999
+        fsGroupChangePolicy: OnRootMismatch
      containers:
        - name: katib-mysql
          image: mysql:8.0.29
@@ -68,6 +71,16 @@ spec:
          volumeMounts:
            - name: katib-mysql
              mountPath: /var/lib/mysql
+          securityContext:
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
+            runAsNonRoot: true
+            runAsUser: 999
+            runAsGroup: 999
+            capabilities:
+              drop:
+              - ALL
      volumes:
        - name: katib-mysql
          persistentVolumeClaim:
@@ -33,4 +33,13 @@ spec:
          ports:
            - name: ui
              containerPort: 8080
+          securityContext:
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
+            capabilities:
+              drop:
+              - ALL
      serviceAccountName: katib-ui