feat: add securityContext to manifests

Apply the `securityContext` settings from upstream PR [#768](kubeflow/model-registry#768) Signed-off-by: Paul Boyd <pboyd@redhat.com>
pboyd · Feb 13, 2025 · 15395aa · 15395aa
1 parent eb01bd1
commit 15395aa
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 1 deletion.
diff --git a/.github/workflows/build-image-pr.yml b/.github/workflows/build-image-pr.yml
@@ -61,4 +61,4 @@ jobs:
           ##debug
           #kubectl describe pods
           #kubectl logs -l name=model-registry-db || true
-          kubectl wait --for=condition=Available=true modelregistries/modelregistry-sample --timeout=5m
+          kubectl wait --for=condition=Available=true modelregistries/modelregistry-sample --timeout=5m || (kubectl describe mr; exit 1)
diff --git a/internal/controller/config/templates/deployment.yaml.tmpl b/internal/controller/config/templates/deployment.yaml.tmpl
@@ -34,6 +34,10 @@ spec:
         {{- end}}
         {{- end}}
     spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+        runAsNonRoot: true
       containers:
         - args:
             - --grpc_port={{.Spec.Grpc.Port}}
@@ -197,6 +201,13 @@ spec:
               cpu: {{.Spec.Grpc.Resources.Limits.Cpu}}
               memory: {{.Spec.Grpc.Resources.Limits.Memory}}
             {{- end }}
+          securityContext:
+            runAsUser: 65534
+            runAsGroup: 65534
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
         - args:
             - --hostname=0.0.0.0
             - --port={{.Spec.Rest.Port}}
@@ -233,6 +244,11 @@ spec:
               cpu: {{.Spec.Rest.Resources.Limits.Cpu}}
               memory: {{.Spec.Rest.Resources.Limits.Memory}}
             {{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
       serviceAccountName: {{.Name}}
       volumes:
         {{- if .Spec.Postgres}}