added SCC V2 compliance for privileged and rorfs (#542)

* added SCC V2 compliance for privileged and rorfs Signed-off-by: Nathaniel Graham <[nathaniel.graham@protonmail.com, ngraham@redhat.com]> * Also make some other desired pod-standards changes Signed-off-by: Joe Gdaniec <jgdaniec@redhat.com> --------- Signed-off-by: Nathaniel Graham <[nathaniel.graham@protonmail.com, ngraham@redhat.com]> Signed-off-by: Joe Gdaniec <jgdaniec@redhat.com> Co-authored-by: Nathaniel Graham <[nathaniel.graham@protonmail.com, ngraham@redhat.com]> Co-authored-by: Joe Gdaniec <jgdaniec@redhat.com>
stolostron · Oct 18, 2023 · b0f7b06 · b0f7b06
1 parent c445245
commit b0f7b06
Show file tree

Hide file tree

Showing 2 changed files with 58 additions and 0 deletions.
diff --git a/bundle/manifests/multicluster-engine.clusterserviceversion.yaml b/bundle/manifests/multicluster-engine.clusterserviceversion.yaml
@@ -2412,7 +2412,29 @@ spec:
             metadata:
               labels:
                 control-plane: backplane-operator
+                ocm-antiaffinity-selector: backplane-operator
             spec:
+              affinity:
+                podAntiAffinity:
+                  preferredDuringSchedulingIgnoredDuringExecution:
+                  - podAffinityTerm:
+                      labelSelector:
+                        matchExpressions:
+                        - key: ocm-antiaffinity-selector
+                          operator: In
+                          values:
+                          - backplane-operator
+                      topologyKey: topology.kubernetes.io/zone
+                    weight: 70
+                  - podAffinityTerm:
+                      labelSelector:
+                        matchExpressions:
+                        - key: ocm-antiaffinity-selector
+                          operator: In
+                          values:
+                          - backplane-operator
+                      topologyKey: kubernetes.io/hostname
+                    weight: 35
               containers:
               - args:
                 - --leader-elect
@@ -2447,12 +2469,19 @@ spec:
                     memory: 20Mi
                 securityContext:
                   allowPrivilegeEscalation: false
+                  capabilities:
+                    drop:
+                    - ALL
+                  privileged: false
+                  readOnlyRootFilesystem: true
                 volumeMounts:
                 - mountPath: /tmp/k8s-webhook-server/serving-certs
                   name: cert
                   readOnly: true
               securityContext:
                 runAsNonRoot: true
+                seccompProfile:
+                  type: RuntimeDefault
               serviceAccountName: multicluster-engine-operator
               terminationGracePeriodSeconds: 10
               volumes:

diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
@@ -21,7 +21,29 @@ spec:
     metadata:
       labels:
         control-plane: backplane-operator
+        ocm-antiaffinity-selector: backplane-operator
     spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: ocm-antiaffinity-selector
+                  operator: In
+                  values:
+                  - backplane-operator
+              topologyKey: topology.kubernetes.io/zone
+            weight: 70
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: ocm-antiaffinity-selector
+                  operator: In
+                  values:
+                  - backplane-operator
+              topologyKey: kubernetes.io/hostname
+            weight: 35
       containers:
       - args:
         - --leader-elect
@@ -56,12 +78,19 @@ spec:
             memory: 20Mi
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: true
         volumeMounts:
         - mountPath: /tmp/k8s-webhook-server/serving-certs
           name: cert
           readOnly: true
       securityContext:
         runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: multicluster-engine-operator
       terminationGracePeriodSeconds: 10
       volumes: