feat: make zarf-agent pods comply with offical restricted pod securit…

…y standard (zarf-dev#3036) Signed-off-by: Cade Thomas <[email protected]> Signed-off-by: schristoff <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Cade Thomas <[email protected]> Co-authored-by: schristoff <[email protected]> Co-authored-by: Austin Abro <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
radiusmethod · Dec 12, 2024 · e0577c8 · e0577c8
1 parent b51eb67
commit e0577c8
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/packages/zarf-agent/manifests/deployment.yaml b/packages/zarf-agent/manifests/deployment.yaml
@@ -21,6 +21,13 @@ spec:
         - name: private-registry
       priorityClassName: system-node-critical
       serviceAccountName: zarf
+      # Security context to comply with restricted PSS
+      securityContext:
+        runAsUser: 1000
+        fsGroup: 2000
+        runAsGroup: 2000
+        seccompProfile:
+          type: "RuntimeDefault"
       containers:
         - name: server
           image: "###ZARF_REGISTRY###/###ZARF_CONST_AGENT_IMAGE###:###ZARF_CONST_AGENT_IMAGE_TAG###"
@@ -32,6 +39,12 @@ spec:
               scheme: HTTPS
           ports:
             - containerPort: 8443
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            capabilities:
+              drop: ["ALL"]
           resources:
             requests:
               memory: "32Mi"