Added seccomp files to common/istio-1-22/kubeflow-istio-resources/

Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com>
biswajit-9776 · Jul 6, 2024 · 86a0a05 · 86a0a05
1 parent e0753aa
commit 86a0a05
Show file tree

Hide file tree

Showing 8 changed files with 33 additions and 3 deletions.
diff --git a/common/istio-1-22/kubeflow-istio-resources/base/kustomization.yaml b/common/istio-1-22/kubeflow-istio-resources/base/kustomization.yaml
@@ -4,3 +4,6 @@ resources:
 - kf-istio-resources.yaml
 - cluster-roles.yaml
 namespace: kubeflow
+patches:
+- path: patches/seccomp-istio-ingressgateway.yaml
+- path: patches/seccomp-istiod.yaml
diff --git a/...patches/seccomp-istio-ingressgateway.yaml → ...patches/seccomp-istio-ingressgateway.yaml b/...patches/seccomp-istio-ingressgateway.yaml → ...patches/seccomp-istio-ingressgateway.yaml
diff --git a/...ic/restricted/patches/seccomp-istiod.yaml → ...esources/base/patches/seccomp-istiod.yaml b/...ic/restricted/patches/seccomp-istiod.yaml → ...esources/base/patches/seccomp-istiod.yaml
diff --git a/common/istio-cni-1-22/kubeflow-istio-resources/base/kustomization.yaml b/common/istio-cni-1-22/kubeflow-istio-resources/base/kustomization.yaml
@@ -4,3 +4,6 @@ resources:
 - kf-istio-resources.yaml
 - cluster-roles.yaml
 namespace: kubeflow
+patches:
+- path: patches/seccomp-istio-ingressgateway.yaml
+- path: patches/seccomp-istiod.yaml
diff --git a/...on/istio-cni-1-22/kubeflow-istio-resources/base/patches/seccomp-istio-ingressgateway.yaml b/...on/istio-cni-1-22/kubeflow-istio-resources/base/patches/seccomp-istio-ingressgateway.yaml
@@ -0,0 +1,13 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: istio-ingressgateway
+  namespace: istio-system
+spec:
+  template:
+    spec:
+      containers:
+      - name: istio-proxy
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault
diff --git a/common/istio-cni-1-22/kubeflow-istio-resources/base/patches/seccomp-istiod.yaml b/common/istio-cni-1-22/kubeflow-istio-resources/base/patches/seccomp-istiod.yaml
@@ -0,0 +1,13 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: istiod
+  namespace: istio-system
+spec:
+  template:
+    spec:
+      containers:
+      - name: discovery
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault
diff --git a/contrib/security/PSS/static/baseline/kustomization.yaml b/contrib/security/PSS/static/baseline/kustomization.yaml
@@ -6,4 +6,4 @@ patches:
 - path: patches/istio-labels.yaml
 - path: patches/cert-manager-labels.yaml
 - path: patches/dex-labels.yaml
-- path: patches/oauth2-proxy-labels.yaml
+- path: patches/oauth2-proxy-labels.yaml
diff --git a/contrib/security/PSS/static/restricted/kustomization.yaml b/contrib/security/PSS/static/restricted/kustomization.yaml
@@ -3,8 +3,6 @@ kind: Component
 
 patches:
 - path: patches/kubeflow-labels.yaml
-- path: patches/seccomp-istio-ingressgateway.yaml
-- path: patches/seccomp-istiod.yaml
 - path: patches/istio-labels.yaml
 - path: patches/cert-manager-labels.yaml
 - path: patches/dex-labels.yaml