Merge pull request #36 from vipyrsec/sid/bugfix/security-context

fix: configure security context in containers to mitigate weaknesses
vipyrsec · Feb 3, 2024 · 581ee08 · 581ee08
2 parents ac6c01d + 5e22a08
commit 581ee08
Show file tree

Hide file tree

Showing 5 changed files with 47 additions and 20 deletions.
diff --git a/kubernetes/manifests/discord/bot/deployment.yaml b/kubernetes/manifests/discord/bot/deployment.yaml
@@ -20,3 +20,12 @@ spec:
           envFrom:
             - secretRef:
                 name: bot-env
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            runAsNonRoot: true
+            runAsUser: 10000
+            runAsGroup: 10000
+            readOnlyRootFilesystem: true
diff --git a/kubernetes/manifests/dragonfly/client/deployment.yaml b/kubernetes/manifests/dragonfly/client/deployment.yaml
@@ -20,3 +20,12 @@ spec:
           envFrom:
             - secretRef:
                 name: dragonfly-client-env
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            runAsNonRoot: true
+            runAsUser: 10000
+            runAsGroup: 10000
+            readOnlyRootFilesystem: true
diff --git a/kubernetes/manifests/dragonfly/loader/cronjob.yaml b/kubernetes/manifests/dragonfly/loader/cronjob.yaml
@@ -0,0 +1,20 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  namespace: dragonfly
+  name: dragonfly-loader
+spec:
+  schedule: '* * * * *'
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+            - name: dragonfly-loader
+              image: ghcr.io/vipyrsec/dragonfly-loader:v1.0.1
+              imagePullPolicy: Always
+              envFrom:
+                - secretRef:
+                    name: dragonfly-loader-env
+          restartPolicy: Never
diff --git a/kubernetes/manifests/dragonfly/loader/deployment.yaml b/kubernetes/manifests/dragonfly/loader/deployment.yaml
diff --git a/kubernetes/manifests/dragonfly/mainframe/deployment.yaml b/kubernetes/manifests/dragonfly/mainframe/deployment.yaml
@@ -20,3 +20,12 @@ spec:
           envFrom:
             - secretRef:
                 name: dragonfly-mainframe-env
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            runAsNonRoot: true
+            runAsUser: 10000
+            runAsGroup: 10000
+            readOnlyRootFilesystem: true