Change Details

In both jobs-api and webservices we could review the pod templates for stricter pod security controls in the cluster. For example, we could make sure our templates include: ```lang=yaml securityContext: allowPrivilegeEscalation: false runAsNonRoot: true privileged: false hostNetwork: false hostIPC: false hostPID: false capabilities: drop: - ALL seccompProfile: type: "runtime/default" ``` so we can later enforce it.

In both jobs-api and webservices we need to review the pod templates. Previously, the PodSecurityPolicy mechanism would mutate Pod resources to meet the security criteria. With {T279110} this will no longer be the case, so we need to natively create Pod resources with a configuration that matches both PSP and the replacement policy, a Kyverno policy. At least during the migration period. For example, we could make sure our templates include: ```lang=yaml securityContext: allowPrivilegeEscalation: false runAsNonRoot: true privileged: false hostNetwork: false hostIPC: false hostPID: false capabilities: drop: - ALL seccompProfile: type: "runtime/default" ``` In other words, Pods created both pre-PSP and post-PSP need to validate against the same kyverno policies.

In both jobs-api and webservices we could review the pod templates for stricter pod security controls in the clusterneed to review the pod templates. Previously, the PodSecurityPolicy mechanism would mutate Pod resources to meet the security criteria. With {T279110} this will no longer be the case, so we need to natively create Pod resources with a configuration that matches both PSP and the replacement policy, a Kyverno policy. At least during the migration period. For example, we could make sure our templates include: ```lang=yaml securityContext: allowPrivilegeEscalation: false runAsNonRoot: true privileged: false hostNetwork: false hostIPC: false hostPID: false capabilities: drop: - ALL seccompProfile: type: "runtime/default" ``` so we can later enforce itIn other words, Pods created both pre-PSP and post-PSP need to validate against the same kyverno policies.