From 61d7806f1838669f4569dec4b2efb702739ff057 Mon Sep 17 00:00:00 2001
From: Devin Buhl <devin@buhl.casa>
Date: Thu, 1 Feb 2024 07:17:55 -0500
Subject: [PATCH] fix: add security contexts to SUC

Signed-off-by: Devin Buhl <devin@buhl.casa>
---
 .../system-upgrade-controller/app/helmrelease.yaml.j2       | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/helmrelease.yaml.j2
index 4abca852..bdc4ebfa 100644
--- a/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/helmrelease.yaml.j2
@@ -46,6 +46,12 @@ spec:
                 valueFrom:
                   fieldRef:
                     fieldPath: metadata.namespace
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+              seccompProfile:
+                type: RuntimeDefault
         pod:
           securityContext:
             runAsUser: 65534