In security context is capabilities NET_BIND_SERVICE needed?

[twingate-blee]

Is the capabilities NET_BIND_SERVICE needed?

To pass the pod security policy

kubectl label --dry-run=server --overwrite ns sops \
   pod-security.kubernetes.io/enforce=restricted \
   pod-security.kubernetes.io/enforce-version=latest

I would like to change the security context to

    capabilities:
      drop:
        - all

vs

    capabilities:
      drop:
        - all
      add:
        - NET_BIND_SERVICE

[isindir]

@twingate-blee , you can override default values as you want: https://github.com/isindir/sops-secrets-operator/blob/master/chart/helm3/sops-secrets-operator/values.yaml#L170

[twingate-blee]

@isindir Yes I already did that. My question is that is add NET_BIND_SERVICE needed? Will I have any issues with the application if I override the default value and remove it?

[isindir]

@twingate-blee I think the operator does not depend on this setting, I introduced it to cover request for more secure settings for the operator pod.