Peter Razumovsky 97a13628e5 core: add capabilities to securityContext to fix CIS 5.2.8 ...

Resolves CIS benchmark 5.2.8 rule by adding capabilities with
explicitly defined empty "add" list (where it needed) and with
NET_RAW capability in "drop" list.

5.2.8 Minimize the admission of containers with added capabilities

Containers must drop the `NET_RAW` capability and are not permitted
to add back any capabilities.

Signed-off-by: Peter Razumovsky <prazumovsky@mirantis.com>

2024-11-05 16:27:43 +04:00

..

cephfs

core: add capabilities to securityContext to fix CIS 5.2.8

2024-11-05 16:27:43 +04:00

nfs

core: add capabilities to securityContext to fix CIS 5.2.8

2024-11-05 16:27:43 +04:00

rbd

core: add capabilities to securityContext to fix CIS 5.2.8

2024-11-05 16:27:43 +04:00

csi-logrotate-sidecar.yaml

csi: add sc privileged to logrotate sidecar container

2024-09-30 20:14:09 +05:30