diff --git a/cmd/kubeadm/app/util/staticpod/utils.go b/cmd/kubeadm/app/util/staticpod/utils.go index c3ff18b93b7..59e09699785 100644 --- a/cmd/kubeadm/app/util/staticpod/utils.go +++ b/cmd/kubeadm/app/util/staticpod/utils.go @@ -67,6 +67,11 @@ func ComponentPod(container v1.Container, volumes map[string]v1.Volume, annotati PriorityClassName: "system-node-critical", HostNetwork: true, Volumes: VolumeMapToSlice(volumes), + SecurityContext: &v1.PodSecurityContext{ + SeccompProfile: &v1.SeccompProfile{ + Type: v1.SeccompProfileTypeRuntimeDefault, + }, + }, }, } } diff --git a/cmd/kubeadm/app/util/staticpod/utils_test.go b/cmd/kubeadm/app/util/staticpod/utils_test.go index dfb0eafc85b..4eca7f1edb9 100644 --- a/cmd/kubeadm/app/util/staticpod/utils_test.go +++ b/cmd/kubeadm/app/util/staticpod/utils_test.go @@ -408,6 +408,11 @@ func TestComponentPod(t *testing.T) { Labels: map[string]string{"component": "foo", "tier": "control-plane"}, }, Spec: v1.PodSpec{ + SecurityContext: &v1.PodSecurityContext{ + SeccompProfile: &v1.SeccompProfile{ + Type: v1.SeccompProfileTypeRuntimeDefault, + }, + }, Containers: []v1.Container{ { Name: "foo",