Allow for SPIRE Agent to run as non root user (#209)

Co-authored-by: Marco Franssen <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
2023-06-17 10:32:41 +02:00
parent 9cf6049afd
commit a6dcf267d1
5 changed files with 57 additions and 0 deletions
@@ -54,6 +54,18 @@ spire-agent:
  server:
    namespaceOverride: spire-server
  priorityClassName: system-node-critical
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+  securityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault

  logLevel: info