diff --git a/pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/manager/config.go b/pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/manager/config.go index 8ff3038cac9..7e9a5b69baf 100644 --- a/pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/manager/config.go +++ b/pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/manager/config.go @@ -72,8 +72,14 @@ spec: spec: securityContext: runAsNonRoot: true - seccompProfile: - type: RuntimeDefault + # TODO(user): For common cases that do not require escalating privileges + # it is recommended to ensure that all your Pods/Containers are restrictive. + # More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted + # Please uncomment the following code if you are NOT looking + # for to built projects which must work on old Kubernetes versions < 1.19 or + # on vendors versions which are NOT supporting this field by default (i.e. Openshift < 4.11 ). + # seccompProfile: + # type: RuntimeDefault containers: - command: - /manager diff --git a/pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/manager/config.go b/pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/manager/config.go index 8ff3038cac9..6071dbf029c 100644 --- a/pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/manager/config.go +++ b/pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/manager/config.go @@ -72,6 +72,10 @@ spec: spec: securityContext: runAsNonRoot: true + # Note: Do no use the seccompProfile if you are looking for + # to support old Kubernetes versions < 1.19 or distribute + # your solutions on vendors versions which are not supporting + # it like Openshift versions < 4.11. seccompProfile: type: RuntimeDefault containers: diff --git a/testdata/project-v3-addon/config/manager/manager.yaml b/testdata/project-v3-addon/config/manager/manager.yaml index d857a2f90f7..075d0c9e1c9 100644 --- a/testdata/project-v3-addon/config/manager/manager.yaml +++ b/testdata/project-v3-addon/config/manager/manager.yaml @@ -26,8 +26,14 @@ spec: spec: securityContext: runAsNonRoot: true - seccompProfile: - type: RuntimeDefault + # TODO(user): For common cases that do not require escalating privileges + # it is recommended to ensure that all your Pods/Containers are restrictive. + # More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted + # Please uncomment the following code if you are NOT looking + # for to built projects which must work on old Kubernetes versions < 1.19 or + # on vendors versions which are NOT supporting this field by default (i.e. Openshift < 4.11 ). + # seccompProfile: + # type: RuntimeDefault containers: - command: - /manager diff --git a/testdata/project-v3-config/config/manager/manager.yaml b/testdata/project-v3-config/config/manager/manager.yaml index e6ba8de7902..58ac6060136 100644 --- a/testdata/project-v3-config/config/manager/manager.yaml +++ b/testdata/project-v3-config/config/manager/manager.yaml @@ -26,8 +26,14 @@ spec: spec: securityContext: runAsNonRoot: true - seccompProfile: - type: RuntimeDefault + # TODO(user): For common cases that do not require escalating privileges + # it is recommended to ensure that all your Pods/Containers are restrictive. + # More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted + # Please uncomment the following code if you are NOT looking + # for to built projects which must work on old Kubernetes versions < 1.19 or + # on vendors versions which are NOT supporting this field by default (i.e. Openshift < 4.11 ). + # seccompProfile: + # type: RuntimeDefault containers: - command: - /manager diff --git a/testdata/project-v3-multigroup/config/manager/manager.yaml b/testdata/project-v3-multigroup/config/manager/manager.yaml index d857a2f90f7..075d0c9e1c9 100644 --- a/testdata/project-v3-multigroup/config/manager/manager.yaml +++ b/testdata/project-v3-multigroup/config/manager/manager.yaml @@ -26,8 +26,14 @@ spec: spec: securityContext: runAsNonRoot: true - seccompProfile: - type: RuntimeDefault + # TODO(user): For common cases that do not require escalating privileges + # it is recommended to ensure that all your Pods/Containers are restrictive. + # More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted + # Please uncomment the following code if you are NOT looking + # for to built projects which must work on old Kubernetes versions < 1.19 or + # on vendors versions which are NOT supporting this field by default (i.e. Openshift < 4.11 ). + # seccompProfile: + # type: RuntimeDefault containers: - command: - /manager diff --git a/testdata/project-v3-v1beta1/config/manager/manager.yaml b/testdata/project-v3-v1beta1/config/manager/manager.yaml index d857a2f90f7..075d0c9e1c9 100644 --- a/testdata/project-v3-v1beta1/config/manager/manager.yaml +++ b/testdata/project-v3-v1beta1/config/manager/manager.yaml @@ -26,8 +26,14 @@ spec: spec: securityContext: runAsNonRoot: true - seccompProfile: - type: RuntimeDefault + # TODO(user): For common cases that do not require escalating privileges + # it is recommended to ensure that all your Pods/Containers are restrictive. + # More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted + # Please uncomment the following code if you are NOT looking + # for to built projects which must work on old Kubernetes versions < 1.19 or + # on vendors versions which are NOT supporting this field by default (i.e. Openshift < 4.11 ). + # seccompProfile: + # type: RuntimeDefault containers: - command: - /manager diff --git a/testdata/project-v3-with-kustomize-v2/config/manager/manager.yaml b/testdata/project-v3-with-kustomize-v2/config/manager/manager.yaml index d857a2f90f7..e1d9a7e10c6 100644 --- a/testdata/project-v3-with-kustomize-v2/config/manager/manager.yaml +++ b/testdata/project-v3-with-kustomize-v2/config/manager/manager.yaml @@ -26,6 +26,10 @@ spec: spec: securityContext: runAsNonRoot: true + # Note: Do no use the seccompProfile if you are looking for + # to support old Kubernetes versions < 1.19 or distribute + # your solutions on vendors versions which are not supporting + # it like Openshift versions < 4.11. seccompProfile: type: RuntimeDefault containers: diff --git a/testdata/project-v3/config/manager/manager.yaml b/testdata/project-v3/config/manager/manager.yaml index d857a2f90f7..075d0c9e1c9 100644 --- a/testdata/project-v3/config/manager/manager.yaml +++ b/testdata/project-v3/config/manager/manager.yaml @@ -26,8 +26,14 @@ spec: spec: securityContext: runAsNonRoot: true - seccompProfile: - type: RuntimeDefault + # TODO(user): For common cases that do not require escalating privileges + # it is recommended to ensure that all your Pods/Containers are restrictive. + # More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted + # Please uncomment the following code if you are NOT looking + # for to built projects which must work on old Kubernetes versions < 1.19 or + # on vendors versions which are NOT supporting this field by default (i.e. Openshift < 4.11 ). + # seccompProfile: + # type: RuntimeDefault containers: - command: - /manager