vmware-tanzu/helm-charts

Drop ALL Capabilities by Default

Open

#418 opened on Nov 18, 2022

View on GitHubContributor guide
 (0 comments) (0 reactions) (0 assignees)Mustache (404 forks)auto 404
good first issuesecurityvelero

Repository metrics

Stars
 (312 stars)
PR merge metrics
 (PR metrics pending)

Description

Describe the problem/challenge you have Currently it seems that

containerSecurityContext: {}
  # capabilities:
  #   drop: ["ALL"]

is commented out from the container security context. If the container does not require those capabilities, would it be possible to uncomment it by default.

Describe the solution you'd like Would be to uncomment and have the drop all capabilities by default. As this would improve the security posture of the chart.

Anything else you would like to add: NONE

Environment:

  • helm version (use helm version): v3.10.0
  • helm chart version and app version (use helm list -n <YOUR NAMESPACE>): v2.32.2 & 1.19.3
  • Kubernetes version (use kubectl version): v1.25.3
  • Kubernetes installer & version: v1.24.6
  • Cloud provider or hardware configuration: Azure
  • OS (e.g. from /etc/os-release):

Contributor guide

Research direction
Verify that dropping all capabilities does not affect the functionality of the application deployed by this chart.
Tech stack
kubernetes
Domain
infrastructuresecurity
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
1
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
KubernetesHelm
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
90