From d60ee8ba0e38f119cbdd56262fd92641d36b4fb9 Mon Sep 17 00:00:00 2001
From: lyndon-li <98304688+Lyndon-Li@users.noreply.github.com>
Date: Fri, 14 Aug 2026 15:30:45 +0800
Subject: [PATCH] clarify the security context to velero server (#10256)

Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
---
 changelogs/unreleased/10256-Lyndon-Li | 1 +
 pkg/install/deployment.go             | 9 +++++++++
 2 files changed, 10 insertions(+)
 create mode 100644 changelogs/unreleased/10256-Lyndon-Li

diff --git a/changelogs/unreleased/10256-Lyndon-Li b/changelogs/unreleased/10256-Lyndon-Li
new file mode 100644
index 000000000..c9fdb5779
--- /dev/null
+++ b/changelogs/unreleased/10256-Lyndon-Li
@@ -0,0 +1 @@
+Clarify the security context to Velero server
\ No newline at end of file
diff --git a/pkg/install/deployment.go b/pkg/install/deployment.go
index 6bea8b0be..d1b751ca1 100644
--- a/pkg/install/deployment.go
+++ b/pkg/install/deployment.go
@@ -444,6 +444,15 @@ func Deployment(namespace string, opts ...podTemplateOption) *appsv1api.Deployme
 								},
 							},
 							Resources: c.resources,
+							SecurityContext: &corev1api.SecurityContext{
+								Capabilities: &corev1api.Capabilities{
+									Drop: []corev1api.Capability{"ALL"},
+								},
+								AllowPrivilegeEscalation: ptr.To(false),
+								SeccompProfile: &corev1api.SeccompProfile{
+									Type: corev1api.SeccompProfileTypeRuntimeDefault,
+								},
+							},
 						},
 					},
 					Volumes: []corev1api.Volume{