Added security_context

nullstone-modules · Aug 8, 2023 · eaa0e15 · eaa0e15
1 parent a5198d7
commit eaa0e15
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 1 deletion.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -4,6 +4,8 @@ on:
     tags:
       - 'v*'
 
+permissions: read-all
+
 env:
   NULLSTONE_ORG: nullstone
   NULLSTONE_API_KEY: ${{ secrets.NULLSTONE_API_KEY }}

diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
@@ -9,7 +9,7 @@ env:
   NULLSTONE_API_KEY: ${{ secrets.NULLSTONE_API_KEY }}
 
 jobs:
-  publish:
+  scan:
     runs-on: ubuntu-latest
 
     defaults:

diff --git a/deployment.tf b/deployment.tf
@@ -34,6 +34,12 @@ resource "kubernetes_deployment_v1" "this" {
           image = "${local.service_image}:${local.app_version}"
           args  = local.command
 
+          security_context {
+            capabilities {
+              drop = ["NET_RAW"]
+            }
+          }
+
           resources {
             limits = {
               cpu    = var.cpu