search

sitewards / helm-chart

Makes develping the chart boilerplate easier.
MIT License
33 stars 12 forks source link

CAP DROP #17

Closed andrewhowdencom closed 7 years ago

andrewhowdencom commented 7 years ago

Kubernetes allows us to drop capabilities. We should drop everything by default, and only allow what's required.

https://kubernetes.io/docs/concepts/policy/container-capabilities/

Do this by creating and consuming a pod security policy context

https://kubernetes.io/docs/concepts/policy/pod-security-policy/#strategies

andrewhowdencom commented 7 years ago

After some thinking, I'm not sure this makes sense. It's the sort of thing that seccomp is better for