Secured Containers

Overview

Change Default settings of:

• PodSecurityContext
  • FSGroup is set to 3000
  • SeccompProfile type is set to RuntimeDefault
• SecurityContext (Container)
  • RunAsUser is set to 1000
  • RunAsGroup is set to 2000
  • RunAsNonRoot is set to true
  • ReadOnlyRootFilesystem is set to true
  • Capabilities.Drop is set to ["ALL"]

Additionally, the shared lifecycle volume (mounted at /lifecycle/tools) is mounted read-only in all runtime containers; only the init-lifecycle init container, which copies the operator binary into it, mounts it read-write.

Dependencies

• Operator Ephemeral Volumes should be Enabled and Supported.

How to use

To enable this feature use --deployment.feature.secured-containers arg, which needs be passed to the operator:

helm upgrade --install kube-arangodb \
https://github.com/arangodb/kube-arangodb/releases/download/$VER/kube-arangodb-$VER.tgz \
  --set "operator.args={--deployment.feature.secured-containers}"