Skip to content

Commit 7d497f9

Browse files
author
Jonathan S. Katz
committed
Explicitly set "privileged" security context to false
While this is the default option in Kubernetes, this ensures that the Operator containers use this setting.
1 parent 000f58c commit 7d497f9

15 files changed

+24
-0
lines changed

‎deploy/deployment.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
"imagePullPolicy": "IfNotPresent",
3535
"securityContext": {
3636
"allowPrivilegeEscalation": false,
37+
"privileged": false,
3738
"readOnlyRootFilesystem": true
3839
},
3940
"ports": [
@@ -123,6 +124,7 @@
123124
"imagePullPolicy": "IfNotPresent",
124125
"securityContext": {
125126
"allowPrivilegeEscalation": false,
127+
"privileged": false,
126128
"readOnlyRootFilesystem": true
127129
},
128130
"readinessProbe": {
@@ -179,6 +181,7 @@
179181
"image": "$PGO_IMAGE_PREFIX/pgo-scheduler:$PGO_IMAGE_TAG",
180182
"securityContext": {
181183
"allowPrivilegeEscalation": false,
184+
"privileged": false,
182185
"readOnlyRootFilesystem": true
183186
},
184187
"livenessProbe": {
@@ -236,6 +239,7 @@
236239
"image": "$PGO_IMAGE_PREFIX/pgo-event:$PGO_IMAGE_TAG",
237240
"securityContext": {
238241
"allowPrivilegeEscalation": false,
242+
"privileged": false,
239243
"readOnlyRootFilesystem": true
240244
},
241245
"livenessProbe": {

‎installers/ansible/roles/pgo-operator/files/pgo-configs/backrest-job.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@
4444
"image": "{{.CCPImagePrefix}}/crunchy-pgbackrest:{{.CCPImageTag}}",
4545
"securityContext": {
4646
"allowPrivilegeEscalation": false,
47+
"privileged": false,
4748
"readOnlyRootFilesystem": true
4849
},
4950
"volumeMounts": [

‎installers/ansible/roles/pgo-operator/files/pgo-configs/cluster-bootstrap-job.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
"image": "{{.CCPImagePrefix}}/{{.CCPImage}}:{{.CCPImageTag}}",
3232
"securityContext": {
3333
"allowPrivilegeEscalation": false,
34+
"privileged": false,
3435
"readOnlyRootFilesystem": true
3536
},
3637
{{.ContainerResources}}

‎installers/ansible/roles/pgo-operator/files/pgo-configs/cluster-deployment.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@
4444
"image": "{{.CCPImagePrefix}}/{{.CCPImage}}:{{.CCPImageTag}}",
4545
"securityContext": {
4646
"allowPrivilegeEscalation": false,
47+
"privileged": false,
4748
"readOnlyRootFilesystem": true
4849
},
4950
"readinessProbe": {

‎installers/ansible/roles/pgo-operator/files/pgo-configs/exporter.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"image": "{{.PGOImagePrefix}}/crunchy-postgres-exporter:{{.PGOImageTag}}",
44
"securityContext": {
55
"allowPrivilegeEscalation": false,
6+
"privileged": false,
67
"readOnlyRootFilesystem": true
78
},
89
"ports": [{

‎installers/ansible/roles/pgo-operator/files/pgo-configs/pgadmin-template.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@
4545
"image": "{{.CCPImagePrefix}}/crunchy-pgadmin4:{{.CCPImageTag}}",
4646
"securityContext": {
4747
"allowPrivilegeEscalation": false,
48+
"privileged": false,
4849
"readOnlyRootFilesystem": true
4950
},
5051
"ports": [{

‎installers/ansible/roles/pgo-operator/files/pgo-configs/pgbadger.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"image": "{{.CCPImagePrefix}}/crunchy-pgbadger:{{.CCPImageTag}}",
44
"securityContext": {
55
"allowPrivilegeEscalation": false,
6+
"privileged": false,
67
"readOnlyRootFilesystem": true
78
},
89
"ports": [ {

‎installers/ansible/roles/pgo-operator/files/pgo-configs/pgbouncer-template.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@
5050
"image": "{{.CCPImagePrefix}}/crunchy-pgbouncer:{{.CCPImageTag}}",
5151
"securityContext": {
5252
"allowPrivilegeEscalation": false,
53+
"privileged": false,
5354
"readOnlyRootFilesystem": true
5455
},
5556
"ports": [{

‎installers/ansible/roles/pgo-operator/files/pgo-configs/pgdump-job.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@
4646
"image": "{{.CCPImagePrefix}}/crunchy-postgres-ha:{{.CCPImageTag}}",
4747
"securityContext": {
4848
"allowPrivilegeEscalation": false,
49+
"privileged": false,
4950
"readOnlyRootFilesystem": true
5051
},
5152
"command": ["/opt/crunchy/bin/uid_postgres.sh"],

‎installers/ansible/roles/pgo-operator/files/pgo-configs/pgo-backrest-repo-template.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@
5454
"image": "{{.CCPImagePrefix}}/crunchy-pgbackrest-repo:{{.CCPImageTag}}",
5555
"securityContext": {
5656
"allowPrivilegeEscalation": false,
57+
"privileged": false,
5758
"readOnlyRootFilesystem": true
5859
},
5960
"ports": [{

0 commit comments

Comments
 (0)