SCC V2 privilaged and ro root filesystem (stolostron#1175)

* added SCC V2 compliance for privileged and rorfs Signed-off-by: Nathaniel Graham <[[email protected], [email protected]]> * Additional pod-standards changes Signed-off-by: Nathaniel Graham <[[email protected], [email protected]]> * Added ocm-antiaffinity-selector template label Signed-off-by: Nathaniel Graham <[[email protected], [email protected]]> * Added ocm-antiaffinity-selector template label to bundle too Signed-off-by: Nathaniel Graham <[[email protected], [email protected]]> --------- Signed-off-by: Nathaniel Graham <[[email protected], [email protected]]> Co-authored-by: Nathaniel Graham <[[email protected], [email protected]]>
zlayne · Oct 18, 2023 · 5d30bb4 · 5d30bb4
1 parent 5ffb1e9
commit 5d30bb4
Show file tree

Hide file tree

Showing 2 changed files with 58 additions and 0 deletions.
diff --git a/bundle/manifests/multiclusterhub-operator.clusterserviceversion.yaml b/bundle/manifests/multiclusterhub-operator.clusterserviceversion.yaml
@@ -580,7 +580,29 @@ spec:
             metadata:
               labels:
                 name: multiclusterhub-operator
+                ocm-antiaffinity-selector: multiclusterhub-operator
             spec:
+              affinity:
+                podAntiAffinity:
+                  preferredDuringSchedulingIgnoredDuringExecution:
+                  - podAffinityTerm:
+                      labelSelector:
+                        matchExpressions:
+                        - key: ocm-antiaffinity-selector
+                          operator: In
+                          values:
+                          - multiclusterhub-operator
+                      topologyKey: topology.kubernetes.io/zone
+                    weight: 70
+                  - podAffinityTerm:
+                      labelSelector:
+                        matchExpressions:
+                        - key: ocm-antiaffinity-selector
+                          operator: In
+                          values:
+                          - multiclusterhub-operator
+                      topologyKey: kubernetes.io/hostname
+                    weight: 35
               containers:
               - args:
                 - --leader-elect
@@ -619,12 +641,19 @@ spec:
                     memory: 256Mi
                 securityContext:
                   allowPrivilegeEscalation: false
+                  capabilities:
+                    drop:
+                    - ALL
+                  privileged: false
+                  readOnlyRootFilesystem: true
                 volumeMounts:
                 - mountPath: /tmp/k8s-webhook-server/serving-certs
                   name: cert
                   readOnly: true
               securityContext:
                 runAsNonRoot: true
+                seccompProfile:
+                  type: RuntimeDefault
               serviceAccountName: multiclusterhub-operator
               terminationGracePeriodSeconds: 10
               volumes:

diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
@@ -23,9 +23,33 @@ spec:
     metadata:
       labels:
         name: multiclusterhub-operator
+        ocm-antiaffinity-selector: multiclusterhub-operator
     spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: ocm-antiaffinity-selector
+                  operator: In
+                  values:
+                  - multiclusterhub-operator
+              topologyKey: topology.kubernetes.io/zone
+            weight: 70
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: ocm-antiaffinity-selector
+                  operator: In
+                  values:
+                  - multiclusterhub-operator
+              topologyKey: kubernetes.io/hostname
+            weight: 35
       securityContext:
         runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - command:
         - multiclusterhub-operator
@@ -36,6 +60,11 @@ spec:
         name: multiclusterhub-operator
         securityContext:
           allowPrivilegeEscalation: false
+          privileged: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+              - ALL
         livenessProbe:
           httpGet:
             path: /healthz