infra/kubernetes
1
0
Fork 0
Code Pull Requests 3 Activity

kitchen: Run as non-root user

Browse Source 
The *kitchen* server service does not need to run as root or have any
access to writable storage.
This commit is contained in:
Dustin
2024-06-06 11:03:42 -05:00
parent b4d6dfeb07
commit c3c9c0c555
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
kitchen/kitchen.yaml
View File

@@ -42,11 +42,17 @@ spec:
ports: ports:
- containerPort: 8000 - containerPort: 8000
name: http name: http
securityContext:
readOnlyRootFilesystem: true
volumeMounts: volumeMounts:
- name: config - name: config
mountPath: /kitchen.yaml mountPath: /kitchen.yaml
subPath: config.yaml subPath: config.yaml
readOnly: true readOnly: true
securityContext:
runAsNonRoot: true
runAsUser: 17402
runAsGroup: 17402
volumes: volumes:
- name: config - name: config
secret: secret: