Merge f8356c9dee into 909e9eabe4

cmd/k8s-operator/manifests/operator.yaml

@@ -18,7 +18,7 @@ metadata:
   name: proxies
   namespace: tailscale
 rules:
-- apiGroups: [""]
+  - apiGroups: [""]
     resources: ["secrets"]
     verbs: ["*"]
 ---
@@ -28,7 +28,7 @@ metadata:
   name: proxies
   namespace: tailscale
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
     name: proxies
     namespace: tailscale
 roleRef:
@@ -47,7 +47,7 @@ kind: ClusterRole
 metadata:
   name: tailscale-operator
 rules:
-- apiGroups: [""]
+  - apiGroups: [""]
     resources: ["services", "services/status"]
     verbs: ["*"]
 ---
@@ -56,7 +56,7 @@ kind: ClusterRoleBinding
 metadata:
   name: tailscale-operator
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
     name: operator
     namespace: tailscale
 roleRef:
@@ -70,10 +70,10 @@ metadata:
   name: operator
   namespace: tailscale
 rules:
-- apiGroups: [""]
+  - apiGroups: [""]
     resources: ["secrets"]
     verbs: ["*"]
-- apiGroups: ["apps"]
+  - apiGroups: ["apps"]
     resources: ["statefulsets"]
     verbs: ["*"]
 ---
@@ -83,7 +83,7 @@ metadata:
   name: operator
   namespace: tailscale
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
     name: operator
     namespace: tailscale
 roleRef:
@@ -119,6 +119,8 @@ spec:
     spec:
       serviceAccountName: operator
       volumes:
+        - name: config
+          emptyDir: {}
         - name: oauth
           secret:
             secretName: operator-oauth
@@ -151,6 +153,20 @@ spec:
             - name: AUTH_PROXY
               value: "false"
           volumeMounts:
+            - name: config
+              mountPath: /.config
             - name: oauth
               mountPath: /oauth
               readOnly: true
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            allowPrivilegeEscalation: false
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 3000
+        runAsNonRoot: true
+        fsGroup: 2000
+        seccompProfile:
+          type: RuntimeDefault

cmd/k8s-operator/manifests/proxy.yaml

@@ -14,7 +14,10 @@ spec:
         - name: sysctler
           image: busybox
           securityContext:
-            privileged: true
+            capabilities:
+              drop:
+                - ALL
+            allowPrivilegeEscalation: false
           command: ["/bin/sh"]
           args:
             - -c
@@ -35,3 +38,13 @@ spec:
             capabilities:
               add:
                 - NET_ADMIN
+              drop:
+                - ALL
+            allowPrivilegeEscalation: false
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 3000
+        runAsNonRoot: true
+        fsGroup: 2000
+        seccompProfile:
+          type: RuntimeDefault