diff --git a/charts/nginx-gateway-fabric/templates/deployment.yaml b/charts/nginx-gateway-fabric/templates/deployment.yaml index 6abed60a4a..1dabe35a12 100644 --- a/charts/nginx-gateway-fabric/templates/deployment.yaml +++ b/charts/nginx-gateway-fabric/templates/deployment.yaml @@ -115,6 +115,8 @@ spec: periodSeconds: 1 {{- end }} securityContext: + seccompProfile: + type: RuntimeDefault allowPrivilegeEscalation: {{ .Values.nginxGateway.securityContext.allowPrivilegeEscalation }} capabilities: add: @@ -151,6 +153,8 @@ spec: - containerPort: 443 name: https securityContext: + seccompProfile: + type: RuntimeDefault capabilities: add: - NET_BIND_SERVICE diff --git a/charts/nginx-gateway-fabric/templates/scc.yaml b/charts/nginx-gateway-fabric/templates/scc.yaml index 8b6b741434..afeddcae19 100644 --- a/charts/nginx-gateway-fabric/templates/scc.yaml +++ b/charts/nginx-gateway-fabric/templates/scc.yaml @@ -27,6 +27,8 @@ supplementalGroups: max: 1001 seLinuxContext: type: MustRunAs +seccompProfiles: +- runtime/default volumes: - emptyDir - secret diff --git a/config/tests/static-deployment.yaml b/config/tests/static-deployment.yaml index 4544caf4ea..73ad539084 100644 --- a/config/tests/static-deployment.yaml +++ b/config/tests/static-deployment.yaml @@ -58,6 +58,8 @@ spec: initialDelaySeconds: 3 periodSeconds: 1 securityContext: + seccompProfile: + type: RuntimeDefault allowPrivilegeEscalation: false capabilities: add: @@ -87,6 +89,8 @@ spec: - containerPort: 443 name: https securityContext: + seccompProfile: + type: RuntimeDefault capabilities: add: - NET_BIND_SERVICE diff --git a/deploy/manifests/nginx-gateway-experimental.yaml b/deploy/manifests/nginx-gateway-experimental.yaml index 68571eff79..1da745fa5c 100644 --- a/deploy/manifests/nginx-gateway-experimental.yaml +++ b/deploy/manifests/nginx-gateway-experimental.yaml @@ -214,6 +214,8 @@ spec: initialDelaySeconds: 3 periodSeconds: 1 securityContext: + seccompProfile: + type: RuntimeDefault allowPrivilegeEscalation: false capabilities: add: @@ -243,6 +245,8 @@ spec: - containerPort: 443 name: https securityContext: + seccompProfile: + type: RuntimeDefault capabilities: add: - NET_BIND_SERVICE diff --git a/deploy/manifests/nginx-gateway.yaml b/deploy/manifests/nginx-gateway.yaml index 689355cbbe..135031dc34 100644 --- a/deploy/manifests/nginx-gateway.yaml +++ b/deploy/manifests/nginx-gateway.yaml @@ -210,6 +210,8 @@ spec: initialDelaySeconds: 3 periodSeconds: 1 securityContext: + seccompProfile: + type: RuntimeDefault allowPrivilegeEscalation: false capabilities: add: @@ -239,6 +241,8 @@ spec: - containerPort: 443 name: https securityContext: + seccompProfile: + type: RuntimeDefault capabilities: add: - NET_BIND_SERVICE diff --git a/deploy/manifests/nginx-plus-gateway-experimental.yaml b/deploy/manifests/nginx-plus-gateway-experimental.yaml index 28e125362b..f690092614 100644 --- a/deploy/manifests/nginx-plus-gateway-experimental.yaml +++ b/deploy/manifests/nginx-plus-gateway-experimental.yaml @@ -221,6 +221,8 @@ spec: initialDelaySeconds: 3 periodSeconds: 1 securityContext: + seccompProfile: + type: RuntimeDefault allowPrivilegeEscalation: false capabilities: add: @@ -250,6 +252,8 @@ spec: - containerPort: 443 name: https securityContext: + seccompProfile: + type: RuntimeDefault capabilities: add: - NET_BIND_SERVICE diff --git a/deploy/manifests/nginx-plus-gateway.yaml b/deploy/manifests/nginx-plus-gateway.yaml index 762eb5d324..8e6fd9462b 100644 --- a/deploy/manifests/nginx-plus-gateway.yaml +++ b/deploy/manifests/nginx-plus-gateway.yaml @@ -217,6 +217,8 @@ spec: initialDelaySeconds: 3 periodSeconds: 1 securityContext: + seccompProfile: + type: RuntimeDefault allowPrivilegeEscalation: false capabilities: add: @@ -246,6 +248,8 @@ spec: - containerPort: 443 name: https securityContext: + seccompProfile: + type: RuntimeDefault capabilities: add: - NET_BIND_SERVICE diff --git a/deploy/manifests/scc.yaml b/deploy/manifests/scc.yaml index 59bf343b33..3ff4f15773 100644 --- a/deploy/manifests/scc.yaml +++ b/deploy/manifests/scc.yaml @@ -28,6 +28,8 @@ supplementalGroups: max: 1001 seLinuxContext: type: MustRunAs +seccompProfiles: +- runtime/default volumes: - emptyDir - secret