Merge pull request 'fix(openbao): restricted-PodSecurity compliance for snapshot CronJob' (#178) from openbao-snapshot-hardening into master

Reviewed-on: gitea_admin/homelab#178
2026-07-14 00:10:32 +00:00
parent cb3894b2f4 476cfb2d12
commit 2e4fdff9e2
1 changed files with 4 additions and 0 deletions
@@ -46,6 +46,10 @@ spec:
          containers:
            - name: snapshot
              image: quay.io/openbao/openbao:2.5.5 # same image as the server — bao CLI included
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop: ["ALL"]
              command: ["/bin/sh", "-ec"]
              args:
                - |