younsl opened a new pull request, #430: URL: https://github.com/apache/superset-kubernetes-operator/pull/430
## Summary The security reference still says the operator sets no default security context on Superset workload pods. Since 0.3.0 ([#363](https://github.com/apache/superset-kubernetes-operator/pull/363)) that is no longer true: the operator fills allowPrivilegeEscalation false, drops all capabilities, and sets the RuntimeDefault seccomp profile on the main container of every component Deployment and lifecycle task Job, and on the create-database init container. The 0.3.0 release notes already describe this, so the security page now contradicts them. This PR updates the page to match the code. ## Details - The note under What Is In Scope now lists the three defaults and where they apply. It explains that each default is only filled when the field is unset (user values always win) and that the seccomp default is skipped when a pod-level profile is set. - The note also lists what the operator leaves alone: runAsNonRoot, runAsUser, readOnlyRootFilesystem, and user-provided sidecars and init containers. It keeps the reason non-root settings are not defaulted (the Superset image declares a named user, and no numeric UID fits both vanilla Kubernetes and OpenShift), so readers know the restricted Pod Security Standard still needs their own non-root settings. - The matching bullet under What Is Generally Out of Scope now points to that note and narrows the user responsibility to non-root settings, the read-only root filesystem, and user-provided sidecars and init containers. - Wording follows applyContainerSecurityDefaults in internal/controller/deployment_builder.go and its three callers (component Deployments, lifecycle task Jobs, and the create-database init container). <details> <summary>Verification</summary> - make lint-md passes. - mkdocs build in strict mode passes with the pinned docs requirements, and the new in-page link resolves to the What Is In Scope heading. </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
