github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-09-14 21:53:52 +00:00
Code Issues Projects Releases Wiki Activity

Adding recommendations from tallclair.

Browse Source
This commit is contained in:
Paulo Gomes
2019-09-11 19:30:32 +01:00
parent 8dcc976db3
commit 72ee17c5ca
3 changed files with 3 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
cluster/addons/dns/kube-dns/kube-dns.yaml.base
View File

@@ -82,13 +82,12 @@ spec:
labels:
k8s-app: kube-dns
annotations:
seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
prometheus.io/port: "10054"
prometheus.io/scrape: "true"
spec:
priorityClassName: system-cluster-critical
securityContext:
runAsNonRoot: true
supplementalGroups: [ 65534 ]
fsGroup: 65534
tolerations:
@@ -198,8 +197,6 @@ spec:
mountPath: /etc/k8s/dns/dnsmasq-nanny
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: false
runAsNonRoot: false
capabilities:
drop:
- all

5
cluster/addons/dns/kube-dns/kube-dns.yaml.in
View File

@@ -82,13 +82,12 @@ spec:
labels:
k8s-app: kube-dns
annotations:
seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
prometheus.io/port: "10054"
prometheus.io/scrape: "true"
spec:
priorityClassName: system-cluster-critical
securityContext:
runAsNonRoot: true
supplementalGroups: [ 65534 ]
fsGroup: 65534
tolerations:
@@ -198,8 +197,6 @@ spec:
mountPath: /etc/k8s/dns/dnsmasq-nanny
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: false
runAsNonRoot: false
capabilities:
drop:
- all

5
cluster/addons/dns/kube-dns/kube-dns.yaml.sed
View File

@@ -82,13 +82,12 @@ spec:
labels:
k8s-app: kube-dns
annotations:
seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
prometheus.io/port: "10054"
prometheus.io/scrape: "true"
spec:
priorityClassName: system-cluster-critical
securityContext:
runAsNonRoot: true
supplementalGroups: [ 65534 ]
fsGroup: 65534
tolerations:
@@ -198,8 +197,6 @@ spec:
mountPath: /etc/k8s/dns/dnsmasq-nanny
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: false
runAsNonRoot: false
capabilities:
drop:
- all