feat: make zarf-agent pods comply with offical restricted pod security standard

packages/zarf-agent/manifests/deployment.yaml

@@ -21,6 +21,12 @@ spec:
         - name: private-registry
       priorityClassName: system-node-critical
       serviceAccountName: zarf
+      securityContext:
+        runAsUser: 1000
+        fsGroup: 2000
+        runAsGroup: 2000
+        seccompProfile:
+          type: "RuntimeDefault"
       containers:
         - name: server
           image: "###ZARF_REGISTRY###/###ZARF_CONST_AGENT_IMAGE###:###ZARF_CONST_AGENT_IMAGE_TAG###"
@@ -32,6 +38,12 @@ spec:
               scheme: HTTPS
           ports:
             - containerPort: 8443
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            capabilities:
+              drop: ["ALL"]
           resources:
             requests:
               memory: "32Mi"

src/test/nightly/ecr_publish_test.go

@@ -61,6 +61,8 @@ func TestECRPublishing(t *testing.T) {
 	// Ensure we get a warning when trying to inspect the online published package
 	stdOut, stdErr, err = e2e.Zarf(t, "package", "inspect", upstreamPackageURL, keyFlag, "--sbom-out", tmpDir, "--skip-signature-validation")
 	require.NoError(t, err, stdOut, stdErr)
+	require.Contains(t, stdErr, "Validating SBOM checksums")
+
 
 	// Validate that we can pull the package down from ECR
 	stdOut, stdErr, err = e2e.Zarf(t, "package", "pull", upstreamPackageURL)