feat(vaultwarden): configure security context

2024-05-07 17:43:21 +02:00 · 2024-05-07 17:43:21 +02:00 · a6c7b6f6d6
commit a6c7b6f6d6
parent 73d2ff843d
1 changed files with 11 additions and 0 deletions
--- a/vaultwarden/resources/deployment.yaml
+++ b/vaultwarden/resources/deployment.yaml
@ -35,6 +35,12 @@ spec:
        volumeMounts:
          - name: data
            mountPath: /data
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+              - ALL
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
@ -49,3 +55,8 @@ spec:
        - name: data
          persistentVolumeClaim:
            claimName: vaultwarden-data
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        runAsNonRoot: true