Harden Deployment payments so it runs as non-root, cannot escalate, drops all capabilities, uses RuntimeDefault seccomp and has a read-only root filesystem.
Objectifs
- Pod runAsNonRoot true
- Pod seccompProfile RuntimeDefault
- Container allowPrivilegeEscalation false
- Drop ALL capabilities
- readOnlyRootFilesystem true
Étapes suggérées
- Pod-level fields apply to all containers where valid.
- Capability and privilege-escalation fields are container-level.
- An app may need writable emptyDir mounts for temporary paths.
Indices
Voir la solution
# Add pod and container securityContext fields, then apply and verify the Pod reaches Ready.