feat(chart): comply with Pod Security Standards (#3689)

* feat(chart): comply with Pod Security Standards * chore(chart): Update CHANGELOG.md * chore(chart): add ci-values.yaml
kubernetes-sigs · Jun 17, 2023 · 66a770c · 66a770c
1 parent de63396
commit 66a770c
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 0 deletions.
diff --git a/charts/external-dns/CHANGELOG.md b/charts/external-dns/CHANGELOG.md
@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### All Changes
 
+- Disallowed privilege escalation in container security context and set the seccomp profile type to `RuntimeDefault`. ([#3689](https://github.com/kubernetes-sigs/external-dns/pull/3689)) [@nrvnrvn](https://github.com/nrvnrvn)
+
 ## [v1.13.0] - 2023-03-30
 
 ### All Changes

diff --git a/charts/external-dns/ci/ci-values.yaml b/charts/external-dns/ci/ci-values.yaml
@@ -0,0 +1 @@
+provider: inmemory
diff --git a/charts/external-dns/values.yaml b/charts/external-dns/values.yaml
@@ -43,8 +43,11 @@ shareProcessNamespace: false
 
 podSecurityContext:
   fsGroup: 65534
+  seccompProfile:
+    type: RuntimeDefault
 
 securityContext:
+  allowPrivilegeEscalation: false
   runAsNonRoot: true
   runAsUser: 65534
   readOnlyRootFilesystem: true