Refine individual capabilities assigned on each helm shard configuration
Problem
At the moment all the CI containers are run in privileged mode, due to the configuration:
securityContext:
privileged: {{ .Values.isPriviliged }}
Where .isPriviliged: true
.
This is too permissive.
Proposal
We should adhere to the principle of least privilege when setting up our containers. For example with:
securityContext:
capabilities:
add: ["SYS_PTRACE"]
Having this in mind, we should explicitly list the individual capabilities that are needed by each component, and configure them. For example
- gdb:
CAP_SYS_PTRACE
- cta-taped:
CAP_SYS_RAWIO