Add securityContext's to your manager’s Deployment

This is related to upgrade operator-sdk to v1.6.0: https://sdk.operatorframework.io/docs/upgrading-sdk-version/v1.6.0/ operator-framework/operator-sdk#4655 Signed-off-by: Wayne Sun <gsun@redhat.com>
waynesun09 · Apr 22, 2021 · 185c455 · 185c455
1 parent ce5c1d0
commit 185c455
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/bundle/manifests/reportportal-operator.clusterserviceversion.yaml b/bundle/manifests/reportportal-operator.clusterserviceversion.yaml
@@ -575,8 +575,22 @@ spec:
                 - name: ANSIBLE_GATHERING
                   value: explicit
                 image: quay.io/waynesun09/rp5-operator:v0.0.7
+                livenessProbe:
+                  httpGet:
+                    path: /healthz
+                    port: 6789
+                  initialDelaySeconds: 15
+                  periodSeconds: 20
                 name: manager
+                readinessProbe:
+                  httpGet:
+                    path: /readyz
+                    port: 6789
+                  initialDelaySeconds: 5
+                  periodSeconds: 10
                 resources: {}
+                securityContext:
+                  allowPrivilegeEscalation: false
               - args:
                 - --secure-listen-address=0.0.0.0:8443
                 - --upstream=http://127.0.0.1:8080/
@@ -588,6 +602,8 @@ spec:
                 - containerPort: 8443
                   name: https
                 resources: {}
+              securityContext:
+                runAsNonRoot: true
               terminationGracePeriodSeconds: 10
       permissions:
       - rules:

diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
@@ -22,6 +22,8 @@ spec:
       labels:
         control-plane: controller-manager
     spec:
+      securityContext:
+        runAsNonRoot: true
       containers:
         - name: manager
           args:
@@ -30,6 +32,8 @@ spec:
           env:
             - name: ANSIBLE_GATHERING
               value: explicit
+          securityContext:
+            allowPrivilegeEscalation: false
           image: controller:latest
           livenessProbe:
             httpGet: