diff --git a/deploy/hubble/manifests/controller/helm/retina/templates/operator/deployment.yaml b/deploy/hubble/manifests/controller/helm/retina/templates/operator/deployment.yaml index 899ca9f126..e70d1ed0df 100644 --- a/deploy/hubble/manifests/controller/helm/retina/templates/operator/deployment.yaml +++ b/deploy/hubble/manifests/controller/helm/retina/templates/operator/deployment.yaml @@ -45,8 +45,7 @@ spec: tolerations: {{- toYaml .Values.operator.tolerations | nindent 8 }} {{- end }} securityContext: - runAsNonRoot: true - runAsUser: 1000 + {{- toYaml .Values.operator.podSecurityContext | nindent 8 }} containers: - image: {{ .Values.operator.repository }}:{{ .Values.operator.tag }} imagePullPolicy: {{ .Values.operator.pullPolicy }} @@ -82,10 +81,7 @@ spec: - name: retina-operator-config mountPath: /retina/ securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - "ALL" + {{- toYaml .Values.operator.securityContext | nindent 12 }} # livenessProbe: # httpGet: # path: /healthz diff --git a/deploy/hubble/manifests/controller/helm/retina/values.yaml b/deploy/hubble/manifests/controller/helm/retina/values.yaml index 807ff3657a..7512f98973 100644 --- a/deploy/hubble/manifests/controller/helm/retina/values.yaml +++ b/deploy/hubble/manifests/controller/helm/retina/values.yaml @@ -36,6 +36,16 @@ operator: # Namespace used for operator leader election lease. # Defaults to .Release.Namespace when empty. leaderElectionNamespace: "" + # -- retina-operator pod-level security context. + podSecurityContext: + runAsNonRoot: true + runAsUser: 1000 + # -- retina-operator container-level security context. + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL agent: leaderElection: false