mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-31 03:45:17 +00:00
Code Activity

Modify capabilities for compatibility with Pod Security (#3274)

Browse source 
Kyverno manifests are incompatible with the restricted Pod Security
Standards included with Kubernetes 1.22 and 1.23 because the Pod
Security admission controller looks for "ALL" in securityContext.capabilities.drop,
but does not accept "all".

1b741f89aa/policy/check_capabilities_restricted.go (L88)

Signed-off-by: Ryan White <ryan@alzabo.io>
This commit is contained in:
Ryan White 2022-02-22 03:14:17 -05:00 • committed by GitHub
parent 99efd8136f
commit c13aeca7fa
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 8 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
charts/kyverno/templates/deployment.yaml
View file

@ -78,7 +78,7 @@ spec:
readOnlyRootFilesystem: true
capabilities:
drop:
- all
- ALL
env:
- name: METRICS_CONFIG
value: {{ template "kyverno.metricsConfigMapName" . }}
@ -108,7 +108,7 @@ spec:
readOnlyRootFilesystem: true
capabilities:
drop:
- all
- ALL
ports:
- containerPort: 9443
name: https

4
config/install.yaml
View file

@ -7957,7 +7957,7 @@ spec:
allowPrivilegeEscalation: false
capabilities:
drop:
- all
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsNonRoot: true
@ -7983,7 +7983,7 @@ spec:
allowPrivilegeEscalation: false
capabilities:
drop:
- all
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsNonRoot: true

4
config/manifest/deployment.yaml
View file

@ -54,7 +54,7 @@ spec:
readOnlyRootFilesystem: true
capabilities:
drop:
- all
- ALL
env:
- name: METRICS_CONFIG
value: kyverno-metrics
@ -100,7 +100,7 @@ spec:
readOnlyRootFilesystem: true
capabilities:
drop:
- all
- ALL
resources:
requests:
memory: 128Mi

4
config/release/install.yaml
View file

@ -7957,7 +7957,7 @@ spec:
allowPrivilegeEscalation: false
capabilities:
drop:
- all
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsNonRoot: true
@ -7983,7 +7983,7 @@ spec:
allowPrivilegeEscalation: false
capabilities:
drop:
- all
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsNonRoot: true