Kube lint - #39

You'll need to bump the chart version as well. Please bump the minor version for this change.

You'll need to bump the chart version as well. Please bump the minor version for this change.

done

ah, I didn't realize you actually require the containers to run under root with the default settings. That's why the tests are currently failing, so I am setting it to runAsNonRoot: false

@mrueg @haad ping

I notice that the default CoreDNS deployment in EKS seems to have this security context:

securityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    add:
      - NET_BIND_SERVICE
    drop:
      - all

Would that help get around some of the downsides of not being able to set runAsNonRoot: true?

Hi, thanks for the PR. I believe that @sarahhodne approach will do the trick in working areound running as non root. Please rebase and bump the chart version

The image now supports this: it has run as the distroless nonroot user (65532) since 1.11.0, and 1.14.7 pins the numeric ids so runAsNonRoot can be verified (coredns/coredns#8316). #277 makes runAsNonRoot, the numeric user and the RuntimeDefault seccomp profile the chart's defaults, so they pass the restricted Pod Security Standard; readOnlyRootFilesystem is already a default.