Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support containerSecurityContext per deployment #264

Open
mjnagel opened this issue Apr 24, 2023 · 0 comments
Open

Support containerSecurityContext per deployment #264

mjnagel opened this issue Apr 24, 2023 · 0 comments

Comments

@mjnagel
Copy link
Contributor

mjnagel commented Apr 24, 2023

Currently the only way to set container security context for the deployments is via anchoreGlobal.containerSecurityContext. While this is useful for a lot of things ("sane" default security) there are also cases where it falls short and you may want a more specific/locked down securityContext applied to a specific container, or more permissive applied to another.

Example deployment for reference: https://github.com/anchore/anchore-charts/blob/main/stable/anchore-engine/templates/api_deployment.yaml#L108-L111

What I would suggest we do is continue to allow for an anchoreGlobal value to set all container security contexts, but also allow (at minimum) a deployment specific option (i.e. anchoreApi.containerSecurityContext). This could easily be expanded if you want even more fine grained control over each container in a given deployment, but in my opinion a deployment wide setting should be sufficient for the "90%" use case.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant