When using Pod Security Admission in the Agents namespace
with the restricted
Pod Security Standard, the
jnlp
container cannot be scheduled without overriding its container definition with a securityContext
.
This option allows to automatically inject in the jnlp
container a securityContext
that is suitable for the use
of the restricted
Pod Security Standard.
This is the securityContext
that will be used for the jnlp
container with that option:
securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true seccompProfile: type: RuntimeDefault