components/*: Forbid write access to root filesystem

Signed-off-by: GitHub <noreply@github.com>
2022-01-27 09:13:18 +00:00
parent 48b2bb6a72
commit 57c46a2861
13 changed files with 33 additions and 5 deletions
--- a/jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet
+++ b/jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet
@@ -62,5 +62,6 @@ function(params) {
    runAsGroup: 65532,
    runAsNonRoot: true,
    allowPrivilegeEscalation: false,
+    readOnlyRootFilesystem: true,
  },
 }