mirrors/node-feature-discovery
1
0
Fork 0
mirror of https://github.com/kubernetes-sigs/node-feature-discovery.git synced 2024-12-14 11:57:51 +00:00
Code Activity

Merge pull request #325 from marquiz/devel/hardening

Browse source 
Container image hardening
This commit is contained in:
Kubernetes Prow Robot 2020-08-21 02:51:39 -07:00 committed by GitHub
commit a68a4ec4fb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 33 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
Dockerfile
View file

@ -25,6 +25,9 @@ RUN make test
# Create production image for running node feature discovery
FROM debian:stretch-slim
# Run as unprivileged user
USER 65534:65534
# Use more verbose logging of gRPC
ENV GRPC_GO_LOG_SEVERITY_LEVEL="INFO"

12
nfd-daemonset-combined.yaml.template
View file

@ -64,6 +64,12 @@ spec:
fieldPath: spec.nodeName
image: k8s.gcr.io/nfd/node-feature-discovery:v0.6.0
name: nfd-master
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
readOnlyRootFilesystem: true
runAsNonRoot: true
command:
- "nfd-master"
- env:
@ -73,6 +79,12 @@ spec:
fieldPath: spec.nodeName
image: k8s.gcr.io/nfd/node-feature-discovery:v0.6.0
name: nfd-worker
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
readOnlyRootFilesystem: true
runAsNonRoot: true
command:
- "nfd-worker"
args:

6
nfd-master.yaml.template
View file

@ -79,6 +79,12 @@ spec:
fieldPath: spec.nodeName
image: k8s.gcr.io/nfd/node-feature-discovery:v0.6.0
name: nfd-master
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
readOnlyRootFilesystem: true
runAsNonRoot: true
command:
- "nfd-master"
## Enable TLS authentication

6
nfd-worker-daemonset.yaml.template
View file

@ -23,6 +23,12 @@ spec:
fieldPath: spec.nodeName
image: k8s.gcr.io/nfd/node-feature-discovery:v0.6.0
name: nfd-worker
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
readOnlyRootFilesystem: true
runAsNonRoot: true
command:
- "nfd-worker"
args:

6
nfd-worker-job.yaml.template
View file

@ -32,6 +32,12 @@ spec:
fieldPath: spec.nodeName
image: k8s.gcr.io/nfd/node-feature-discovery:v0.6.0
name: nfd-worker
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
readOnlyRootFilesystem: true
runAsNonRoot: true
command:
- "nfd-worker"
args: