drop NET_RAW capability from maintenance container

Signed-off-by: Ivan Milchev <[email protected]>
podkrepi-bg · Nov 1, 2022 · 33c6f9a · 33c6f9a
1 parent 0fc2914
commit 33c6f9a
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/manifests/base/maintenance.yaml b/manifests/base/maintenance.yaml
@@ -39,6 +39,9 @@ spec:
           securityContext:
             runAsNonRoot: true
             readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - NET_RAW
           volumeMounts:
             - name: tmp
               mountPath: /tmp