From 50846ebe9a122ce05fbc11ffb8b5142a53054b16 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Thu, 16 Feb 2023 10:38:01 +0100
Subject: [PATCH] Improve spiffe-csi security-context

Co-authored-by: Faisal Memon <fymemon@yahoo.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 .../spire/charts/spiffe-csi-driver/templates/daemonset.yaml   | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
index 40e72b9..c9c06d0 100644
--- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
@@ -56,6 +56,10 @@ spec:
               mountPropagation: Bidirectional
               name: mountpoint-dir
           securityContext:
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - all
             privileged: true
           resources:
             {{- toYaml .Values.resources | nindent 12 }}