Merge pull request #134 from jk-cluster/feat/rallly-seccomp-runtimedefault

rallly: seccompProfile RuntimeDefault in the pod context

rallly/Chart.yaml

@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/lukevella/rallly/main/apps/landing/publi
 
 type: application
 
-version: 7.0.0+up4.12.3
+version: 8.0.0+up4.12.3
 appVersion: "4.12.3"
 
 maintainers:

rallly/templates/_helpers.tpl

@@ -220,7 +220,8 @@ AVD-KSV-0022 for the older deployed chart version (#84).
       "runAsUser" 20000
       "runAsGroup" 1000
       "fsGroup" 1000
-      "fsGroupChangePolicy" "Always" -}}
+      "fsGroupChangePolicy" "Always"
+      "seccompProfile" (dict "type" "RuntimeDefault") -}}
 {{- include "rallly.defaultedDict" (dict "defaults" $defaults "given" $given "path" "rallly.securityContext.pod") -}}
 {{- end -}}
 

rallly/values.yaml

@@ -62,6 +62,15 @@ rallly:
       runAsGroup: 1000
       fsGroup: 1000
       fsGroupChangePolicy: Always
+      # RuntimeDefault applies the container runtime's default seccomp filter,
+      # which blocks the syscalls a normal workload never makes. It sits in the
+      # pod context on purpose: from here it covers every container in the pod
+      # including init containers, while a container-level seccompProfile would
+      # have to be repeated for each one (and silently missed on the next one
+      # added). A container that genuinely needs a different filter can still
+      # override it under securityContext.container, which wins over this value.
+      seccompProfile:
+        type: RuntimeDefault
     container:
       allowPrivilegeEscalation: false
       readOnlyRootFilesystem: true