clarify the security context to velero server (#10256)

Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
2026-08-16 04:06:06 +00:00 · 2026-08-14 15:30:45 +08:00
parent 4f55fb5a65
commit d60ee8ba0e
2 changed files with 10 additions and 0 deletions
@@ -0,0 +1 @@
+Clarify the security context to Velero server
@@ -444,6 +444,15 @@ func Deployment(namespace string, opts ...podTemplateOption) *appsv1api.Deployme
 								},
 							},
 							Resources: c.resources,
+							SecurityContext: &corev1api.SecurityContext{
+								Capabilities: &corev1api.Capabilities{
+									Drop: []corev1api.Capability{"ALL"},
+								},
+								AllowPrivilegeEscalation: ptr.To(false),
+								SeccompProfile: &corev1api.SeccompProfile{
+									Type: corev1api.SeccompProfileTypeRuntimeDefault,
+								},
+							},
 						},
 					},
 					Volumes: []corev1api.Volume{
				`@@ -0,0 +1 @@`
				`Clarify the security context to Velero server`