Merge "[memcached] Allign with security best practices"

2025-01-07 11:47:39 +00:00 · 2025-01-07 11:47:39 +00:00 · b2e6f27af4
commit b2e6f27af4
parent 7544151284 725dc5518d
2 changed files with 9 additions and 1 deletions
--- a/memcached/templates/statefulset.yaml
+++ b/memcached/templates/statefulset.yaml
@ -132,6 +132,6 @@ spec:
        - name: memcached-bin
          configMap:
            name: {{ $configMapBinName | quote }}
-            defaultMode: 0555
+            defaultMode: 360
 {{ dict "envAll" $envAll "component" "memcached" "requireSys" true | include "helm-toolkit.snippets.kubernetes_apparmor_volumes" | indent 8 }}
 {{- end }}
--- a/memcached/values.yaml
+++ b/memcached/values.yaml
@ -150,13 +150,21 @@ pod:
    server:
      pod:
        runAsUser: 65534
+        runAsNonRoot: true
+        fsGroup: 65534
      container:
        memcached:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+              - ALL
        memcached_exporter:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+              - ALL
  probes:
    memcached:
      memcached: