diff --git a/charts/scheduler/templates/sched-anchor.yaml b/charts/scheduler/templates/sched-anchor.yaml index 467ba910..71f9b19c 100644 --- a/charts/scheduler/templates/sched-anchor.yaml +++ b/charts/scheduler/templates/sched-anchor.yaml @@ -40,6 +40,7 @@ spec: labels: {{ $labels | indent 8 }} spec: +{{ dict "envAll" $envAll "application" "scheduler" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} hostNetwork: true dnsPolicy: {{ .Values.anchor.dns_policy }} nodeSelector: @@ -55,6 +56,7 @@ spec: image: {{ .Values.images.tags.anchor }} imagePullPolicy: {{ .Values.images.pull_policy }} {{ tuple $envAll $envAll.Values.pod.resources.anchor_daemonset | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} +{{ dict "envAll" $envAll "application" "scheduler" "container" "anchor" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} command: - /tmp/bin/anchor lifecycle: diff --git a/charts/scheduler/values.yaml b/charts/scheduler/values.yaml index 61df491c..a1b0be06 100644 --- a/charts/scheduler/values.yaml +++ b/charts/scheduler/values.yaml @@ -25,6 +25,14 @@ labels: node_selector_value: enabled pod: + security_context: + scheduler: + pod: + runAsUser: 65534 + container: + anchor: + runAsUser: 0 + readOnlyRootFilesystem: true lifecycle: upgrades: daemonsets: