security: enable readOnlyRootFilesystem for MIC and NMI (#1225)

Signed-off-by: Ernest Wong <[email protected]>
Azure · Jan 5, 2022 · 00f812d · 00f812d
1 parent 22d1edb
commit 00f812d
Show file tree

Hide file tree

Showing 5 changed files with 6 additions and 1 deletion.
diff --git a/manifest_staging/charts/aad-pod-identity/templates/mic-deployment.yaml b/manifest_staging/charts/aad-pod-identity/templates/mic-deployment.yaml
@@ -96,10 +96,11 @@ spec:
           {{- if .Values.customUserAgent }}
           - --custom-user-agent={{ .Values.customUserAgent }}
           {{- end }}
-        {{- if not .Values.adminsecret }}
         securityContext:
+        {{- if not .Values.adminsecret }}
           runAsUser: 0
         {{- end }}
+          readOnlyRootFilesystem: true
         env:
           - name: MIC_POD_NAMESPACE
             valueFrom:

diff --git a/manifest_staging/deploy/infra/deployment-rbac.yaml b/manifest_staging/deploy/infra/deployment-rbac.yaml
@@ -601,6 +601,7 @@ spec:
           - "--logtostderr"
         securityContext:
           runAsUser: 0
+          readOnlyRootFilesystem: true
         env:
         - name: MIC_POD_NAMESPACE
           valueFrom:

diff --git a/manifest_staging/deploy/infra/deployment.yaml b/manifest_staging/deploy/infra/deployment.yaml
@@ -503,6 +503,7 @@ spec:
           - "--logtostderr"
         securityContext:
           runAsUser: 0
+          readOnlyRootFilesystem: true
         env:
         - name: MIC_POD_NAMESPACE
           valueFrom:

diff --git a/manifest_staging/deploy/infra/noazurejson/deployment-rbac.yaml b/manifest_staging/deploy/infra/noazurejson/deployment-rbac.yaml
@@ -610,6 +610,7 @@ spec:
           - "--logtostderr"
         securityContext:
           runAsUser: 0
+          readOnlyRootFilesystem: true
         env:
           - name: MIC_POD_NAMESPACE
             valueFrom:

diff --git a/manifest_staging/deploy/infra/noazurejson/deployment.yaml b/manifest_staging/deploy/infra/noazurejson/deployment.yaml
@@ -514,6 +514,7 @@ spec:
           - "--logtostderr"
         securityContext:
           runAsUser: 0
+          readOnlyRootFilesystem: true
         env:
           - name: MIC_POD_NAMESPACE
             valueFrom: