fix: Only add SC capabilities if vault templating is used (#218)

Signed-off-by: Ivaylo Ivanov <ivaylo.ivanov@oeamtc.at>

Author: sedadas

pkg/webhook/pod.go

@@ -859,13 +859,7 @@ func getBaseSecurityContext(podSecurityContext *corev1.PodSecurityContext, vault
 		AllowPrivilegeEscalation: &vaultConfig.PspAllowPrivilegeEscalation,
 		ReadOnlyRootFilesystem:   &vaultConfig.ReadOnlyRootFilesystem,
 		Capabilities: &corev1.Capabilities{
-			Add: []corev1.Capability{
-				"CHOWN",
-				"SETFCAP",
-				"SETGID",
-				"SETPCAP",
-				"SETUID",
-			},
+			Add: []corev1.Capability{},
 			Drop: []corev1.Capability{
 				"ALL",
 			},

pkg/webhook/pod_test.go

@@ -514,13 +514,7 @@ func Test_mutatingWebhook_mutatePod(t *testing.T) {
 		ReadOnlyRootFilesystem:   &vaultConfig.ReadOnlyRootFilesystem,
 		AllowPrivilegeEscalation: &vaultConfig.PspAllowPrivilegeEscalation,
 		Capabilities: &corev1.Capabilities{
-			Add: []corev1.Capability{
-				"CHOWN",
-				"SETFCAP",
-				"SETGID",
-				"SETPCAP",
-				"SETUID",
-			},
+			Add: []corev1.Capability{},
 			Drop: []corev1.Capability{
 				"ALL",
 			},