From 119e8c3428ac95016e064ecbce51ed3868fe9c07 Mon Sep 17 00:00:00 2001 From: Andrew Bays Date: Mon, 24 Aug 2026 05:38:59 -0400 Subject: [PATCH] Add seccompProfile to sub-operator deployment template The managers.yaml template generates Deployments for ~20 child operators. While the template already includes readOnlyRootFilesystem and capability drop (added in 010517ca), it was missing seccompProfile at the pod security context level. This adds seccompProfile: type RuntimeDefault to match the umbrella operator's own deployment and satisfy the Restricted Pod Security Standard. Co-Authored-By: Claude Sonnet 4.5 --- bindata/operator/managers.yaml | 2 ++ config/operator/managers.yaml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/bindata/operator/managers.yaml b/bindata/operator/managers.yaml index 08f26dd3c..0e7cf990e 100644 --- a/bindata/operator/managers.yaml +++ b/bindata/operator/managers.yaml @@ -86,6 +86,8 @@ spec: {{- end }} securityContext: runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: {{ .Name }}-operator-controller-manager terminationGracePeriodSeconds: 10 tolerations: diff --git a/config/operator/managers.yaml b/config/operator/managers.yaml index 08f26dd3c..0e7cf990e 100644 --- a/config/operator/managers.yaml +++ b/config/operator/managers.yaml @@ -86,6 +86,8 @@ spec: {{- end }} securityContext: runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: {{ .Name }}-operator-controller-manager terminationGracePeriodSeconds: 10 tolerations: