depl: drop capabilities from all plugins

Signed-off-by: Tuomas Katila <[email protected]>

Author: tkatila

deployments/dlb_plugin/base/intel-dlb-plugin.yaml

@@ -31,7 +31,12 @@ spec:
         securityContext:
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
-        terminationMessagePath: /tmp/termination-log          
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
+        terminationMessagePath: /tmp/termination-log
         resources:
           requests:
             memory: "15Mi"

deployments/dsa_plugin/base/intel-dsa-plugin.yaml

@@ -33,6 +33,11 @@ spec:
             type: "container_device_plugin_t"
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
         resources:
           requests:
             memory: "25Mi"

deployments/fpga_plugin/base/intel-fpga-plugin-daemonset.yaml

@@ -42,8 +42,15 @@ spec:
           - -mode=af
         terminationMessagePath: /tmp/termination-log
         securityContext:
+          seLinuxOptions:
+            type: "container_device_plugin_t"
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
         resources:
           requests:
             memory: "30Mi"

deployments/gpu_plugin/base/intel-gpu-plugin.yaml

@@ -36,6 +36,11 @@ spec:
             type: "container_device_plugin_t"
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
         resources:
           requests:
             memory: "45Mi"

deployments/iaa_plugin/base/intel-iaa-plugin.yaml

@@ -33,6 +33,11 @@ spec:
             type: "container_device_plugin_t"
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
         resources:
           requests:
             memory: "25Mi"

deployments/qat_plugin/base/intel-qat-plugin.yaml

@@ -36,6 +36,11 @@ spec:
             type: "container_device_plugin_t"
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
         imagePullPolicy: IfNotPresent
         resources:
           requests:

deployments/sgx_plugin/base/intel-sgx-plugin.yaml

@@ -27,6 +27,11 @@ spec:
             type: "container_device_plugin_t"
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
         imagePullPolicy: IfNotPresent
         resources:
           requests: