villebro opened a new pull request, #362: URL: https://github.com/apache/superset-kubernetes-operator/pull/362
## Summary The operator-managed maintenance page (nginx) already defaults its container to a hardened securityContext — non-root, `allowPrivilegeEscalation: false`, all capabilities dropped — and its comment states this "satisfies restricted Pod Security Standards." But the restricted profile also **requires** a `seccompProfile` of `RuntimeDefault` or `Localhost`, which was not set. So in a namespace enforcing the restricted Pod Security Standard the maintenance pod is still rejected, and the comment was inaccurate. This surfaces on hardened clusters (restricted PSS enforced, CIS-benchmarked) exactly when the maintenance page is needed most — during an upgrade drain — where a rejected maintenance pod never becomes ready and stalls the lifecycle. ## Details Default `SeccompProfile` to `RuntimeDefault` in `maintenanceSecurityContext`, respecting any user-provided value (like the existing non-root / capabilities defaults). This completes the hardened default so the maintenance page is admitted under restricted PSS, and makes the comment accurate. `RuntimeDefault` is universally supported by the container runtimes Kubernetes uses, so it is safe on non-hardened clusters too. Scope: this PR addresses only the maintenance page, whose comment overclaimed compliance. The main Superset workloads intentionally leave securityContext to the user (via `podTemplate`/`containerTemplate`); adding hardened defaults there is a broader policy decision left for separate discussion. ### Tests Extended the `TestBuildMaintenanceFlatSpec` "defaults non-root" case to assert the container securityContext sets `seccompProfile: RuntimeDefault`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
