Merge pull request #186 from winston0410/feat/make-controller-non-root

make controller deployment run as nobody and nogroup

Author: winston0410

config/default/manager_auth_proxy_patch.yaml

@@ -20,6 +20,15 @@ spec:
         - containerPort: 8443
           protocol: TCP
           name: https
+        securityContext:
+          runAsNonRoot: false
+          runAsGroup: 65534
+          runAsUser: 65534
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+              - ALL
         resources:
           limits:
             cpu: 500m

config/default/manager_auth_proxy_patch.yaml.template

@@ -20,6 +20,15 @@ spec:
         - containerPort: 8443
           protocol: TCP
           name: https
+        securityContext:
+          runAsNonRoot: false
+          runAsGroup: 65534
+          runAsUser: 65534
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+              - ALL
         resources:
           limits:
             cpu: 500m

config/manager/manager.yaml

@@ -25,6 +25,7 @@ spec:
         control-plane: controller-manager
     spec:
       securityContext:
+        fsGroup: 65534
         runAsNonRoot: true
       containers:
       - command:
@@ -34,7 +35,14 @@ spec:
         image: controller:latest
         name: manager
         securityContext:
+          runAsNonRoot: false
+          runAsGroup: 65534
+          runAsUser: 65534
           allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+              - ALL
         livenessProbe:
           httpGet:
             path: /healthz