Skip to content

Commit 4fad85e

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #2767 from camilamacedo86/uncomment-restricted
✨ leave the pod.spec.containers[0].capabilities.DROP.All uncommented by default
2 parents 175713e + 1246760 commit 4fad85e

File tree

15 files changed

+42
-77
lines changed

15 files changed

+42
-77
lines changed

‎pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/kdefault/manager_auth_proxy_patch.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,9 @@ spec:
5757
- name: kube-rbac-proxy
5858
securityContext:
5959
allowPrivilegeEscalation: false
60-
# TODO(user): uncomment for common cases that do not require escalating privileges
61-
# capabilities:
62-
# drop:
63-
# - "ALL"
60+
capabilities:
61+
drop:
62+
- "ALL"
6463
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.12.0
6564
args:
6665
- "--secure-listen-address=0.0.0.0:8443"

‎pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/manager/config.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -90,10 +90,9 @@ spec:
9090
name: manager
9191
securityContext:
9292
allowPrivilegeEscalation: false
93-
# TODO(user): uncomment for common cases that do not require escalating privileges
94-
# capabilities:
95-
# drop:
96-
# - "ALL"
93+
capabilities:
94+
drop:
95+
- "ALL"
9796
livenessProbe:
9897
httpGet:
9998
path: /healthz

‎pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/kdefault/manager_auth_proxy_patch.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,9 @@ spec:
5757
- name: kube-rbac-proxy
5858
securityContext:
5959
allowPrivilegeEscalation: false
60-
# TODO(user): uncomment for common cases that do not require escalating privileges
61-
# capabilities:
62-
# drop:
63-
# - "ALL"
60+
capabilities:
61+
drop:
62+
- "ALL"
6463
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.12.0
6564
args:
6665
- "--secure-listen-address=0.0.0.0:8443"

‎pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/manager/config.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -90,10 +90,9 @@ spec:
9090
name: manager
9191
securityContext:
9292
allowPrivilegeEscalation: false
93-
# TODO(user): uncomment for common cases that do not require escalating privileges
94-
# capabilities:
95-
# drop:
96-
# - "ALL"
93+
capabilities:
94+
drop:
95+
- "ALL"
9796
livenessProbe:
9897
httpGet:
9998
path: /healthz

‎test/e2e/v3/generate_test.go‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -237,27 +237,6 @@ Count int `+"`"+`json:"count,omitempty"`+"`"+`
237237

238238
func uncommentPodStandards(kbc *utils.TestContext) {
239239
configManager := filepath.Join(kbc.Dir, "config", "manager", "manager.yaml")
240-
managerAuth := filepath.Join(kbc.Dir, "config", "default", "manager_auth_proxy_patch.yaml")
241-
242-
//nolint:lll
243-
if err := pluginutil.ReplaceInFile(configManager, `# TODO(user): uncomment for common cases that do not require escalating privileges
244-
# capabilities:
245-
# drop:
246-
# - "ALL"`, ` capabilities:
247-
drop:
248-
- "ALL"`); err != nil {
249-
ExpectWithOffset(1, err).NotTo(HaveOccurred())
250-
}
251-
252-
//nolint:lll
253-
if err := pluginutil.ReplaceInFile(managerAuth, `# TODO(user): uncomment for common cases that do not require escalating privileges
254-
# capabilities:
255-
# drop:
256-
# - "ALL"`, ` capabilities:
257-
drop:
258-
- "ALL"`); err != nil {
259-
ExpectWithOffset(1, err).NotTo(HaveOccurred())
260-
}
261240

262241
//nolint:lll
263242
if err := pluginutil.ReplaceInFile(configManager, `# TODO(user): For common cases that do not require escalating privileges

‎testdata/project-v3-addon/config/default/manager_auth_proxy_patch.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,9 @@ spec:
1212
- name: kube-rbac-proxy
1313
securityContext:
1414
allowPrivilegeEscalation: false
15-
# TODO(user): uncomment for common cases that do not require escalating privileges
16-
# capabilities:
17-
# drop:
18-
# - "ALL"
15+
capabilities:
16+
drop:
17+
- "ALL"
1918
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.12.0
2019
args:
2120
- "--secure-listen-address=0.0.0.0:8443"

‎testdata/project-v3-addon/config/manager/manager.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,10 +42,9 @@ spec:
4242
name: manager
4343
securityContext:
4444
allowPrivilegeEscalation: false
45-
# TODO(user): uncomment for common cases that do not require escalating privileges
46-
# capabilities:
47-
# drop:
48-
# - "ALL"
45+
capabilities:
46+
drop:
47+
- "ALL"
4948
livenessProbe:
5049
httpGet:
5150
path: /healthz

‎testdata/project-v3-config/config/default/manager_auth_proxy_patch.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,9 @@ spec:
1212
- name: kube-rbac-proxy
1313
securityContext:
1414
allowPrivilegeEscalation: false
15-
# TODO(user): uncomment for common cases that do not require escalating privileges
16-
# capabilities:
17-
# drop:
18-
# - "ALL"
15+
capabilities:
16+
drop:
17+
- "ALL"
1918
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.12.0
2019
args:
2120
- "--secure-listen-address=0.0.0.0:8443"

‎testdata/project-v3-config/config/manager/manager.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,10 +40,9 @@ spec:
4040
name: manager
4141
securityContext:
4242
allowPrivilegeEscalation: false
43-
# TODO(user): uncomment for common cases that do not require escalating privileges
44-
# capabilities:
45-
# drop:
46-
# - "ALL"
43+
capabilities:
44+
drop:
45+
- "ALL"
4746
livenessProbe:
4847
httpGet:
4948
path: /healthz

‎testdata/project-v3-multigroup/config/default/manager_auth_proxy_patch.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,9 @@ spec:
1212
- name: kube-rbac-proxy
1313
securityContext:
1414
allowPrivilegeEscalation: false
15-
# TODO(user): uncomment for common cases that do not require escalating privileges
16-
# capabilities:
17-
# drop:
18-
# - "ALL"
15+
capabilities:
16+
drop:
17+
- "ALL"
1918
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.12.0
2019
args:
2120
- "--secure-listen-address=0.0.0.0:8443"

0 commit comments

Comments
 (0)