villebro opened a new pull request, #362:
URL: https://github.com/apache/superset-kubernetes-operator/pull/362

   ## Summary
   
   The operator-managed maintenance page (nginx) already defaults its container 
to a hardened securityContext — non-root, `allowPrivilegeEscalation: false`, 
all capabilities dropped — and its comment states this "satisfies restricted 
Pod Security Standards." But the restricted profile also **requires** a 
`seccompProfile` of `RuntimeDefault` or `Localhost`, which was not set. So in a 
namespace enforcing the restricted Pod Security Standard the maintenance pod is 
still rejected, and the comment was inaccurate.
   
   This surfaces on hardened clusters (restricted PSS enforced, 
CIS-benchmarked) exactly when the maintenance page is needed most — during an 
upgrade drain — where a rejected maintenance pod never becomes ready and stalls 
the lifecycle.
   
   ## Details
   
   Default `SeccompProfile` to `RuntimeDefault` in 
`maintenanceSecurityContext`, respecting any user-provided value (like the 
existing non-root / capabilities defaults). This completes the hardened default 
so the maintenance page is admitted under restricted PSS, and makes the comment 
accurate. `RuntimeDefault` is universally supported by the container runtimes 
Kubernetes uses, so it is safe on non-hardened clusters too.
   
   Scope: this PR addresses only the maintenance page, whose comment 
overclaimed compliance. The main Superset workloads intentionally leave 
securityContext to the user (via `podTemplate`/`containerTemplate`); adding 
hardened defaults there is a broader policy decision left for separate 
discussion.
   
   ### Tests
   
   Extended the `TestBuildMaintenanceFlatSpec` "defaults non-root" case to 
assert the container securityContext sets `seccompProfile: RuntimeDefault`.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to