From 387731a9454f237692ca930678350833474f14b7 Mon Sep 17 00:00:00 2001
From: Philip Gough <philip.p.gough@gmail.com>
Date: Tue, 14 May 2024 09:31:24 +0100
Subject: [PATCH] ci: Add runAsGroup for kube-state-metrics
---
.../kube-prometheus/components/kube-state-metrics.libsonnet | 3 +++
manifests/kubeStateMetrics-deployment.yaml | 1 +
2 files changed, 4 insertions(+)
diff --git a/jsonnet/kube-prometheus/components/kube-state-metrics.libsonnet b/jsonnet/kube-prometheus/components/kube-state-metrics.libsonnet
index e5d7ac17..1535877e 100644
--- a/jsonnet/kube-prometheus/components/kube-state-metrics.libsonnet
+++ b/jsonnet/kube-prometheus/components/kube-state-metrics.libsonnet
@@ -164,6 +164,9 @@ function(params) (import 'github.com/kubernetes/kube-state-metrics/jsonnet/kube-
ports:: null,
livenessProbe:: null,
readinessProbe:: null,
+ securityContext+: {
+ runAsGroup: 65534,
+ },
args: ['--host=127.0.0.1', '--port=8081', '--telemetry-host=127.0.0.1', '--telemetry-port=8082'],
resources: ksm._config.resources,
}, super.containers) + [kubeRbacProxyMain, kubeRbacProxySelf],
diff --git a/manifests/kubeStateMetrics-deployment.yaml b/manifests/kubeStateMetrics-deployment.yaml
index 076b31cd..910a9fa2 100644
--- a/manifests/kubeStateMetrics-deployment.yaml
+++ b/manifests/kubeStateMetrics-deployment.yaml
@@ -47,6 +47,7 @@ spec:
drop:
- ALL
readOnlyRootFilesystem: true
+ runAsGroup: 65534
runAsNonRoot: true
runAsUser: 65534
seccompProfile:
--
GitLab