cluster

commit 21b2a6bb547271a67ec418ddb038455b66789bbf
parent 52528aa297be6f1760af3e58a999f108faca64ae
Author: MTRNord <mtrnord1@gmail.com>
Date:   Tue, 16 Apr 2024 19:18:39 +0200

Fix slidingsync-proxy

Diffstat:
M
README.md
 | 
4
++++
M
apps/base/matrix/sliding-proxy/deployment.yaml
 | 
6
++----
M
kubeaudit-config.yml
 | 
16
++++++++++++++++

3 files changed, 22 insertions(+), 4 deletions(-)
diff --git a/README.md b/README.md
@@ -166,3 +166,7 @@ infra-controllers       main@sha1:21ebd912      False   True    Applied revision
 - [ ]  Port validate script
 - [x] ~~Setup CI for github and woodpecker~~ (Fluxcd can pull it)
 - [x] Verify sops is working as expected and then publish repo
+
+## Kubeaudit
+
+`find ./  | grep .yaml | xargs -I{} -d'\n' kubeaudit all -k ./kubeaudit-config.yml -f {} > audit.txt`
diff --git a/apps/base/matrix/sliding-proxy/deployment.yaml b/apps/base/matrix/sliding-proxy/deployment.yaml
@@ -17,9 +17,9 @@ spec:
     metadata:
       labels:
         app: sliding-proxy-midnightthoughts
+        container.kubeaudit.io/sliding-proxy-midnightthoughts-container.allow-run-as-root: ""
     spec:
       securityContext:
-        #runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
       automountServiceAccountToken: false
@@ -56,10 +56,8 @@ spec:
               drop:
                 - ALL
             readOnlyRootFilesystem: true
-            #runAsNonRoot: true
-
             privileged: false
-            runAsNonRoot: true
+            runAsNonRoot: false
           resources: {}
   strategy: {}
 ---
diff --git a/kubeaudit-config.yml b/kubeaudit-config.yml
@@ -0,0 +1,16 @@
+enabledAuditors:
+  # Auditors are enabled by default if they are not explicitly set to "false"
+  apparmor: false
+  asat: true
+  capabilities: true
+  deprecatedapis: true
+  hostns: true
+  image: true
+  limits: true
+  mounts: true
+  netpols: true
+  nonroot: true
+  privesc: true
+  privileged: true
+  rootfs: true
+  seccomp: true