Drop Linux capabilities

Signed-off-by: GitHub <noreply@github.com>
2022-02-01 09:25:21 +00:00
parent 6bfb07aac2
commit 931af3241d
14 changed files with 58 additions and 2 deletions
--- a/manifests/nodeExporter-daemonset.yaml
+++ b/manifests/nodeExporter-daemonset.yaml
@@ -45,6 +45,11 @@ spec:
            memory: 180Mi
        securityContext:
          allowPrivilegeEscalation: false
+          capabilities:
+            add:
+            - CAP_SYS_TIME
+            drop:
+            - ALL
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /host/sys
@@ -80,6 +85,9 @@ spec:
            memory: 20Mi
        securityContext:
          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
          readOnlyRootFilesystem: true
          runAsGroup: 65532
          runAsNonRoot: true