From bed910270685dc92a5ce5bd1dfa7cdd1fda1d9d4 Mon Sep 17 00:00:00 2001
From: Dan <danmx@users.noreply.github.com>
Date: Mon, 22 Apr 2019 16:21:44 +0200
Subject: [PATCH] [stable/kiam] KIAM Agent: Using CAP_NET_ADMIN instead
 privileged container (#12017)

* KIAM Agent: Using CAP_NET_ADMIN instead privileged container

Signed-off-by: danmx <daniel@iziourov.info>

* Incrementing version

Signed-off-by: Matt Farina <matt@mattfarina.com>
---
 stable/kiam/Chart.yaml                     | 2 +-
 stable/kiam/templates/agent-daemonset.yaml | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/stable/kiam/Chart.yaml b/stable/kiam/Chart.yaml
index 701640f588..5bcb1fd660 100644
--- a/stable/kiam/Chart.yaml
+++ b/stable/kiam/Chart.yaml
@@ -1,5 +1,5 @@
 name: kiam
-version: 2.2.1
+version: 2.2.2
 appVersion: 3.2
 description: Integrate AWS IAM with Kubernetes
 keywords:
diff --git a/stable/kiam/templates/agent-daemonset.yaml b/stable/kiam/templates/agent-daemonset.yaml
index 090e87af58..1d02dee1b5 100644
--- a/stable/kiam/templates/agent-daemonset.yaml
+++ b/stable/kiam/templates/agent-daemonset.yaml
@@ -65,7 +65,8 @@ spec:
         - name: {{ template "kiam.name" . }}-{{ .Values.agent.name }}
         {{- if .Values.agent.host.iptables }}
           securityContext:
-            privileged: true
+            capabilities:
+              add: ["NET_ADMIN"]
         {{- end }}
           image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag }}"
           imagePullPolicy: {{ .Values.agent.image.pullPolicy }}