Drop Linux capabilities

Signed-off-by: GitHub <noreply@github.com>
2022-02-01 09:25:21 +00:00
parent 6bfb07aac2
commit 931af3241d
14 changed files with 58 additions and 2 deletions
--- a/jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet
+++ b/jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet
@@ -63,5 +63,6 @@ function(params) {
    runAsNonRoot: true,
    allowPrivilegeEscalation: false,
    readOnlyRootFilesystem: true,
+    capabilities: { drop: ['ALL'] },
  },
 }