github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Adding recommendations from tallclair.

Browse Source
This commit is contained in:
Paulo Gomes 2019-09-11 19:30:32 +01:00
parent 8dcc976db3
commit 72ee17c5ca
3 changed files with 3 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
cluster/addons/dns/kube-dns/kube-dns.yaml.base
View File

@ -82,13 +82,12 @@ spec:
labels:
k8s-app: kube-dns
annotations:
seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
prometheus.io/port: "10054"
prometheus.io/scrape: "true"
spec:
priorityClassName: system-cluster-critical
securityContext:
runAsNonRoot: true
supplementalGroups: [ 65534 ]
fsGroup: 65534
tolerations:
@ -198,8 +197,6 @@ spec:
mountPath: /etc/k8s/dns/dnsmasq-nanny
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: false
runAsNonRoot: false
capabilities:
drop:
- all

5
cluster/addons/dns/kube-dns/kube-dns.yaml.in
View File

@ -82,13 +82,12 @@ spec:
labels:
k8s-app: kube-dns
annotations:
seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
prometheus.io/port: "10054"
prometheus.io/scrape: "true"
spec:
priorityClassName: system-cluster-critical
securityContext:
runAsNonRoot: true
supplementalGroups: [ 65534 ]
fsGroup: 65534
tolerations:
@ -198,8 +197,6 @@ spec:
mountPath: /etc/k8s/dns/dnsmasq-nanny
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: false
runAsNonRoot: false
capabilities:
drop:
- all

5
cluster/addons/dns/kube-dns/kube-dns.yaml.sed
View File

@ -82,13 +82,12 @@ spec:
labels:
k8s-app: kube-dns
annotations:
seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
prometheus.io/port: "10054"
prometheus.io/scrape: "true"
spec:
priorityClassName: system-cluster-critical
securityContext:
runAsNonRoot: true
supplementalGroups: [ 65534 ]
fsGroup: 65534
tolerations:
@ -198,8 +197,6 @@ spec:
mountPath: /etc/k8s/dns/dnsmasq-nanny
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: false
runAsNonRoot: false
capabilities:
drop:
- all