charts
charts copied to clipboard
ping test job for cluster fails when complying Kyverno policies
We have restriction in our cluster on the workload privileges. When a cluster is created , the ping test job (from templates/test/ping.yaml) is created automatically and is run with privileged access by default. I can patch the resource to comply with our kyverno policies as below
- op: add
path: /spec/template/spec/securityContext
value:
runAsUser: 1000
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- op: add
path: /spec/template/spec/containers/0/securityContext
value:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
But since the package download is done in the pod, it needs additional permission. Is there a way to disable running this ping test job or make it compliant? Couldnt find a way to do it in the chart options.