securityContext for containers is ignored if useStrictSecurity is not defined.
#1184
Assignees
Labels
bug
Something isn't working
Comments
f41gh7
added a commit
that referenced
this issue
Dec 8, 2024
Previously, with `useStrictSecurity: false` or undefined, explicitly configured `spec.securityContext` options were ignored for `containers`. This commit takes in account `useStrictSecurity` setting and properly add explicit `securityContext` configuration. It improves code readibilty by removing unneded `container.securityContext != nil` checks and makes configuration more obvious. Commit also adds `privileged: false` as default `container` `securityContext` setting. It's applied with `useStrictSecurity: true`. It's needed to pass various security rules checks at `AKS`. Related issue: #1184 Signed-off-by: f41gh7 <[email protected]>
f41gh7
added
the
waiting for release
|
The issue was fixed at v0.51.1 release |
f41gh7
removed
the
waiting for release
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Currently, operator ignores
securityContextfor containers. But it addssecurityContextto thepods. Which caused by improper check foruseStrictSecurityhttps://github.com/VictoriaMetrics/operator/blob/master/internal/controller/operator/factory/build/security.go#L44
Current workaround is to set
useStrictSecurity: true.The text was updated successfully, but these errors were encountered: