cluster

commit 3f595914e652314c158ce9dab9bb02af728dab0c
parent e63fa2ce50c01d47c2cffd486cfb9bf766fde908
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Thu, 19 Feb 2026 13:26:20 +0100

match hardening in the stage env

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
apps/talos_cluster/connectivity-tester/staging_deployment.yaml
 | 
21
++++++++++++++++++++-

1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/apps/talos_cluster/connectivity-tester/staging_deployment.yaml b/apps/talos_cluster/connectivity-tester/staging_deployment.yaml
@@ -17,6 +17,7 @@ spec:
       labels:
         app: connectivity-tester-stage
     spec:
+      automountServiceAccountToken: false
       affinity:
         podAntiAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
@@ -80,9 +81,16 @@ spec:
               memory: "344Mi"
               cpu: "252m"
           securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
             runAsUser: 1000
             runAsGroup: 1000
-            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
           volumeMounts:
             - name: api-config
               mountPath: /app/config.yaml
@@ -115,6 +123,17 @@ spec:
                 command:
                   - sleep
                   - "10"
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
           resources:
             limits: {}
             requests: