From e686df5710b54b3f127f6aac991ba86711609d0e Mon Sep 17 00:00:00 2001
From: ILay <ilia.zakharchuk@t-systems.com>
Date: Mon, 31 Aug 2026 18:40:06 +0200
Subject: [PATCH] [SIMPL-30451] Harden the probe pod against restricted Pod
 Security

The int cluster did not enforce Pod Security when this was written - no namespace labels, no Kyverno or Gatekeeper. The sandbox was NOT checked; there is no kubeconfig context for it. A cluster that does enforce it rejects the pod outright rather than degrading, which is slow to diagnose from an unrelated namespace.

Records the matching gap it cannot fix: PipesK8sClient builds the payload pod specs, and this service passes no securityContext through base_pod_spec, so a restricted namespace would admit the dispatcher and reject every payload it creates.

Changelog: changed
---
 yaml/loosely-coupled/probe-pipes-k8s.yaml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/yaml/loosely-coupled/probe-pipes-k8s.yaml b/yaml/loosely-coupled/probe-pipes-k8s.yaml
index d35cb9c..3acf329 100644
--- a/yaml/loosely-coupled/probe-pipes-k8s.yaml
+++ b/yaml/loosely-coupled/probe-pipes-k8s.yaml
@@ -43,6 +43,13 @@
 # namespaced objects. That is the dry run declining to create the namespace it
 # would need, not a fault in the manifests; `--dry-run=client` passes clean.
 #
+# LIMITATION under a restricted Pod Security namespace. This pod satisfies the
+# restricted standard, but the payload Jobs do not: PipesK8sClient builds those
+# pod specs and this service passes no securityContext through base_pod_spec, so
+# such a namespace would admit the dispatcher and reject every payload it
+# creates. Leave the probe namespace unlabelled, or add the fields to
+# base_pod_spec in dispatch_external_work_k8s first.
+#
 # --- Reading the result ----------------------------------------------------
 #
 #   kubectl -n distexec-probe logs -f job/pipes-probe
@@ -133,10 +140,20 @@ spec:
         runAsGroup: 1000
         # Makes the emptyDir writable by UID 1000, which DAGSTER_HOME needs.
         fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: dispatcher
           image: gitea.dataprovider01.sandbox-cat-dat.simpl-europe.eu/j.r/distributed-execution:5122da4691f9
           imagePullPolicy: IfNotPresent
+          # Satisfies the restricted Pod Security standard. The int cluster did
+          # not enforce it when this was written and the sandbox was not checked;
+          # a cluster that does enforce it rejects the pod outright.
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
           command:
             - dagster
             - job