updated security context constraint for gateway, removed unnecessary …

…permissions
hashicorp · Aug 7, 2023 · f8e7525 · f8e7525
1 parent f101782
commit f8e7525
Showing 1 changed file with 6 additions and 10 deletions.
diff --git a/charts/consul/templates/api-gateway-securitycontextconstraints.yaml b/charts/consul/templates/api-gateway-securitycontextconstraints.yaml
@@ -17,21 +17,17 @@ allowHostDirVolumePlugin: false
 allowHostIPC: false
 allowHostNetwork: {{ .Values.client.hostNetwork }}
 allowHostPID: false
-allowHostPorts: true
+allowHostPorts: false
 allowPrivilegeEscalation: false
-allowPrivilegedContainer: true
-allowedCapabilities: null
-defaultAddCapabilities:
+allowPrivilegedContainer: false
+allowedCapabilities:
   - NET_BIND_SERVICE
-fsGroup:
-  type: RunAsAny
 readOnlyRootFilesystem: true
 requiredDropCapabilities:
   - ALL
 runAsUser:
-  type: RunAsAny
+  type: MustRunAsRange
 seLinuxContext:
-  type: RunAsAny
-supplementalGroups:
-  type: RunAsAny
+  type: MustRunAs
+volumes: []
 {{- end }}