From 3cbc35aaf95e72f29aabef535deaa9b9eb7fbacd Mon Sep 17 00:00:00 2001
From: Vegard Hagen <vegard@stonegarden.dev>
Date: Sun, 5 Jan 2025 15:43:44 +0100
Subject: [PATCH] fix(netbird-signal): harden security

---
 k8s/infra/vpn/netbird/signal/deployment.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/k8s/infra/vpn/netbird/signal/deployment.yaml b/k8s/infra/vpn/netbird/signal/deployment.yaml
index 83225b4..ac4599e 100644
--- a/k8s/infra/vpn/netbird/signal/deployment.yaml
+++ b/k8s/infra/vpn/netbird/signal/deployment.yaml
@@ -16,10 +16,20 @@ spec:
     spec:
       nodeSelector:
         topology.kubernetes.io/zone: abel
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: signal
         image: docker.io/netbirdio/signal:0.35.2 # renovate: docker=docker.io/netbirdio/signal
         args: [--port, $(PORT), --log-level, $(LOG_LEVEL), --log-file, console]
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: false
+          capabilities:
+            drop: [ ALL ]
+            add: [ NET_ADMIN, NET_RAW, PERFMON, BPF ]
         envFrom:
           - configMapRef:
               name: signal-config