-
Notifications
You must be signed in to change notification settings - Fork 6
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Roll out PSS Restricted profile. #1883
Comments
This was
linked to
pull requests
Mar 4, 2024
Ah nuts, auto-closed this by mistake somehow or other. |
It's not rolled out until we're in enforcement mode. Should be mostly just trivial template fixes, plus the not-so-trivial NFS question. |
This was referenced May 1, 2024
This was
unlinked from
pull requests
May 1, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
We currently enforce the PSS baseline profile.
We want tighten that up to Restricted where possible (e.g.
apps
namespace), so that we don't have to worry about regressions in container permissions — i.e. application containers unintentionally/unnecessarily being granted system privileges in future.In other words, this:
We still have a couple of NFS clients (e.g. asset-manager), so we might need to work around that temporarily and/or pay down that tech debt and switch them to S3.
The text was updated successfully, but these errors were encountered: