Peter Razumovsky 97a13628e5 core: add capabilities to securityContext to fix CIS 5.2.8 ...

Resolves CIS benchmark 5.2.8 rule by adding capabilities with
explicitly defined empty "add" list (where it needed) and with
NET_RAW capability in "drop" list.

5.2.8 Minimize the admission of containers with added capabilities

Containers must drop the `NET_RAW` capability and are not permitted
to add back any capabilities.

Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>

2024-11-05 16:27:43 +04:00

..

cleanup_test.go

core: cephblockpoolRadosNamespace cleanup

2024-04-12 21:49:49 +05:30

cleanup.go

core: define empty securityContext for pods to fix CIS 5.7.3

2024-10-09 16:10:03 +04:00

cluster_info_test.go

operator: load cluster owner info in LoadClusterInfo

2024-04-16 13:09:39 -06:00

cluster_info.go

operator: load cluster owner info in LoadClusterInfo

2024-04-16 13:09:39 -06:00

conditions.go

core: add observedGeneration to CR status

2022-03-16 19:58:35 +05:30

controller_utils_test.go

core: add ROOK_REVISION_HISTORY_LIMIT operator setting

2024-10-02 19:40:37 +02:00

controller_utils.go

core: add ROOK_REVISION_HISTORY_LIMIT operator setting

2024-10-02 19:40:37 +02:00

finalizer_test.go

core: add context parameter to opcontroller

2021-10-25 20:45:06 +09:00

finalizer.go

core: add context parameter to opcontroller

2021-10-25 20:45:06 +09:00

handler_test.go

core: api updates for controller runtime v0.15

2023-06-22 10:33:28 -06:00

handler.go

core: api updates for controller runtime v0.15

2023-06-22 10:33:28 -06:00

label.go

docs: fix bunch of typos

2020-11-06 10:01:04 +01:00

mirror_peer_test.go

core: ensure cluster name is available on cluster info

2021-11-18 15:30:26 -07:00

mirror_peer.go

core: fix spelling

2022-07-07 18:10:47 -04:00

network_test.go

core: set resources on the cmd reporter jobs

2024-10-31 14:52:57 -06:00

network.go

core: set resources on the cmd reporter jobs

2024-10-31 14:52:57 -06:00

object_operations.go

core: add context parameter to opcontroller

2021-10-25 20:45:06 +09:00

owner_test.go

ceph: handling gosec errors that are not checked

2020-07-24 20:02:06 +05:30

owner.go

ceph: validate all owner references

2021-03-26 06:43:54 +00:00

predicate_test.go

core: remove support for ceph quincy

2024-10-03 11:12:55 -06:00

predicate.go

core: skip reconcile if override configmap is empty

2024-02-01 14:29:20 -07:00

spec_test.go

core: remove support for ceph pacific

2023-11-14 17:07:03 -07:00

spec.go

core: add capabilities to securityContext to fix CIS 5.2.8

2024-11-05 16:27:43 +04:00

version.go

core: set resources on the cmd reporter jobs

2024-10-31 14:52:57 -06:00