Harden Redis, InstanceHA, Memcached, and DNSMasq workload security

lmiccini · claude · lmiccini · commit 08cf4e2cdff2 · 2026-07-23T16:19:35.000+02:00
Address anyuid SCC and overly permissive RBAC findings across all infra-operator workloads except RabbitMQ. Redis: - Reduce workload SA pod verbs from full CRUD to get/list/watch/patch (only PATCH is used by common.sh for pod label operations) - Add SecurityContext (RunAsUser/RunAsGroup/RunAsNonRoot) - Add SeccompProfile RuntimeDefault - Set AutomountServiceAccountToken: false with projected SA token volume - SCC remains anyuid (sudo -E kolla_set_configs blocks nonroot-v2) InstanceHA: - Change SCC from anyuid to nonroot-v2 - Add SeccompProfile RuntimeDefault - Set AutomountServiceAccountToken: false with projected SA token volume - Use lib-common pod.RestrictiveSecurityContext helper Memcached: - Change SCC from anyuid to nonroot-v2 - Remove full pod CRUD from workload SA (no SA token usage) - Set AutomountServiceAccountToken: false - Add full SecurityContext via pod.RestrictiveSecurityContext helper (RunAsNonRoot, AllowPrivilegeEscalation: false, Drop ALL, SeccompProfile) DNSMasq: - Change SCC from anyuid to nonroot-v2 - Remove full pod CRUD from workload SA (no SA token usage) - Set AutomountServiceAccountToken: false - Add DnsmasqUID constant (42435, neutron UID from kolla) - Add RunAsUser/RunAsGroup and Capabilities.Drop ALL via pod.RestrictiveSecurityContext helper Depends-On: openstack-k8s-operators/lib-common#720 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
diff --git a/apis/go.mod b/apis/go.mod
@@ -70,6 +70,8 @@ require (
 
 replace github.com/openshift/api => github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4 //allow-merging
 
+replace github.com/openstack-k8s-operators/lib-common/modules/common => github.com/lmiccini/lib-common/modules/common v0.0.0-20260723135709-89117b10db4a //allow-merging
+
 // pin these to avoid later versions pulled
 replace k8s.io/apimachinery => k8s.io/apimachinery v0.33.13 //allow-merging
 
diff --git a/apis/go.sum b/apis/go.sum
@@ -64,6 +64,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/lmiccini/lib-common/modules/common v0.0.0-20260723135709-89117b10db4a h1:j+CcLvhJPj9aEc++PW/SR227JigGl42gRgDW2q3en/0=
+github.com/lmiccini/lib-common/modules/common v0.0.0-20260723135709-89117b10db4a/go.mod h1:yA4tbcB62Dml5d0SP3n14hbwLVrKFicm690/eTWvusc=
 github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
 github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -81,8 +83,6 @@ github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
 github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4 h1:YVY7Mb0AdJBbNgC/Zz9R/ZwhixOmZNA8P+6ZPaDW/0M=
 github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4/go.mod h1:SPLf21TYPipzCO67BURkCfK6dcIIxx0oNRVWaOyRcXM=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260717092345-ab1ee7b97c67 h1:crgFl4DA5n38huc043ux21jEQM7UaRMXsi+wogDOYn0=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260717092345-ab1ee7b97c67/go.mod h1:yA4tbcB62Dml5d0SP3n14hbwLVrKFicm690/eTWvusc=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -350,6 +350,14 @@ rules:
   - securitycontextconstraints
   verbs:
   - use
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - nonroot-v2
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
 - apiGroups:
   - topology.openstack.org
   resources:
diff --git a/go.mod b/go.mod
@@ -109,6 +109,8 @@ require (
 
 replace github.com/openstack-k8s-operators/infra-operator/apis => ./apis
 
+replace github.com/openstack-k8s-operators/lib-common/modules/common => github.com/lmiccini/lib-common/modules/common v0.0.0-20260723135709-89117b10db4a //allow-merging
+
 // mschuppert: map to latest commit from release-4.20 tag
 // must consistent within modules and service operators
 replace github.com/openshift/api => github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4 //allow-merging
diff --git a/go.sum b/go.sum
@@ -94,6 +94,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/lmiccini/lib-common/modules/common v0.0.0-20260723135709-89117b10db4a h1:j+CcLvhJPj9aEc++PW/SR227JigGl42gRgDW2q3en/0=
+github.com/lmiccini/lib-common/modules/common v0.0.0-20260723135709-89117b10db4a/go.mod h1:yA4tbcB62Dml5d0SP3n14hbwLVrKFicm690/eTWvusc=
 github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
 github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=
@@ -116,8 +118,6 @@ github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
 github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4 h1:YVY7Mb0AdJBbNgC/Zz9R/ZwhixOmZNA8P+6ZPaDW/0M=
 github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4/go.mod h1:SPLf21TYPipzCO67BURkCfK6dcIIxx0oNRVWaOyRcXM=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260717092345-ab1ee7b97c67 h1:crgFl4DA5n38huc043ux21jEQM7UaRMXsi+wogDOYn0=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260717092345-ab1ee7b97c67/go.mod h1:yA4tbcB62Dml5d0SP3n14hbwLVrKFicm690/eTWvusc=
 github.com/openstack-k8s-operators/lib-common/modules/edpm v0.0.0-20260717092345-ab1ee7b97c67 h1:EoBTLbbfGRC37uA0J6al5zeZfQSxy6XwsUMNZAWCQPA=
 github.com/openstack-k8s-operators/lib-common/modules/edpm v0.0.0-20260717092345-ab1ee7b97c67/go.mod h1:IN0pCq/v2MsPcXrtcBIqcpVEqyq8oTIbNahmsc3tu28=
 github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260717092345-ab1ee7b97c67 h1:GmakXxpm0scnNPuFDC9fSdhqo8MPyyBqqL0UW8pNh5o=
diff --git a/internal/controller/instanceha/instanceha_controller.go b/internal/controller/instanceha/instanceha_controller.go
@@ -95,7 +95,7 @@ func (r *Reconciler) GetLogger(ctx context.Context) logr.Logger {
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch
 // service account permissions that are needed to grant permission to the above
-// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use
+// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=nonroot-v2,resources=securitycontextconstraints,verbs=use
 // +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch
 // +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
 // +kubebuilder:rbac:groups=topology.openstack.org,resources=topologies,verbs=get;list;watch;update
@@ -205,7 +205,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ct
 	rbacRules := []rbacv1.PolicyRule{
 		{
 			APIGroups:     []string{"security.openshift.io"},
-			ResourceNames: []string{"anyuid"},
+			ResourceNames: []string{"nonroot-v2"},
 			Resources:     []string{"securitycontextconstraints"},
 			Verbs:         []string{"use"},
 		},
diff --git a/internal/controller/memcached/memcached_controller.go b/internal/controller/memcached/memcached_controller.go
@@ -103,8 +103,7 @@ func (r *Reconciler) GetLogger(ctx context.Context) logr.Logger {
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch
 // service account permissions that are needed to grant permission to the above
-// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use
-// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch
+// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=nonroot-v2,resources=securitycontextconstraints,verbs=use
 // +kubebuilder:rbac:groups=topology.openstack.org,resources=topologies,verbs=get;list;watch;update
 
 // Reconcile - Memcached
@@ -225,15 +224,10 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ct
 	rbacRules := []rbacv1.PolicyRule{
 		{
 			APIGroups:     []string{"security.openshift.io"},
-			ResourceNames: []string{"anyuid"},
+			ResourceNames: []string{"nonroot-v2"},
 			Resources:     []string{"securitycontextconstraints"},
 			Verbs:         []string{"use"},
 		},
-		{
-			APIGroups: []string{""},
-			Resources: []string{"pods"},
-			Verbs:     []string{"create", "get", "list", "watch", "update", "patch", "delete"},
-		},
 	}
 	rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
 	if err != nil {
diff --git a/internal/controller/network/dnsmasq_controller.go b/internal/controller/network/dnsmasq_controller.go
@@ -97,8 +97,7 @@ func (r *DNSMasqReconciler) GetLogger(ctx context.Context) logr.Logger {
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch
 // service account permissions that are needed to grant permission to the above
-// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use
-// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch
+// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=nonroot-v2,resources=securitycontextconstraints,verbs=use
 // +kubebuilder:rbac:groups=topology.openstack.org,resources=topologies,verbs=get;list;watch;update
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
@@ -205,15 +204,10 @@ func (r *DNSMasqReconciler) Reconcile(ctx context.Context, req ctrl.Request) (re
 	rbacRules := []rbacv1.PolicyRule{
 		{
 			APIGroups:     []string{"security.openshift.io"},
-			ResourceNames: []string{"anyuid"},
+			ResourceNames: []string{"nonroot-v2"},
 			Resources:     []string{"securitycontextconstraints"},
 			Verbs:         []string{"use"},
 		},
-		{
-			APIGroups: []string{""},
-			Resources: []string{"pods"},
-			Verbs:     []string{"create", "get", "list", "watch", "update", "patch", "delete"},
-		},
 	}
 	rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
 	if err != nil {
diff --git a/internal/controller/redis/redis_controller.go b/internal/controller/redis/redis_controller.go
@@ -107,7 +107,7 @@ type Reconciler struct {
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update
 // service account permissions that are needed to grant permission to the above
 // +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use
-// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch
+// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;patch;watch
 // +kubebuilder:rbac:groups=topology.openstack.org,resources=topologies,verbs=get;list;watch;update
 
 // Reconcile - Redis
@@ -219,7 +219,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ct
 		{
 			APIGroups: []string{""},
 			Resources: []string{"pods"},
-			Verbs:     []string{"create", "get", "list", "watch", "update", "patch", "delete"},
+			Verbs:     []string{"get", "list", "watch", "patch"},
 		},
 	}
 	rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
diff --git a/internal/dnsmasq/const.go b/internal/dnsmasq/const.go
@@ -24,4 +24,7 @@ const (
 	DNSPort int32 = 53
 	// DNSTargetPort - port used the service is listening on in the pod
 	DNSTargetPort int32 = 5353
+
+	// DnsmasqUID - https://github.com/openstack/kolla/blob/master/kolla/common/users.py
+	DnsmasqUID int64 = 42435
 )
diff --git a/internal/dnsmasq/deployment.go b/internal/dnsmasq/deployment.go
@@ -26,6 +26,7 @@ import (
 	common "github.com/openstack-k8s-operators/lib-common/modules/common"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/affinity"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/env"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/pod"
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -121,42 +122,31 @@ func Deployment(
 					Labels:      labels,
 				},
 				Spec: corev1.PodSpec{
-					ServiceAccountName: instance.RbacResourceName(),
-					Volumes:            getVolumes(instance.Name, cms),
+					ServiceAccountName:           instance.RbacResourceName(),
+					AutomountServiceAccountToken: ptr.To(false),
+					Volumes:                      getVolumes(instance.Name, cms),
 					InitContainers: []corev1.Container{
 						{
-							Name:    "init",
-							Command: command,
-							Args:    initArgs,
-							Image:   instance.Spec.ContainerImage,
-							SecurityContext: &corev1.SecurityContext{
-								RunAsNonRoot:             ptr.To(true),
-								AllowPrivilegeEscalation: ptr.To(false),
-								SeccompProfile: &corev1.SeccompProfile{
-									Type: corev1.SeccompProfileTypeRuntimeDefault,
-								},
-							},
-							Env:          env.MergeEnvs([]corev1.EnvVar{}, envVars),
-							VolumeMounts: getVolumeMounts(instance.Name, cms),
+							Name:            "init",
+							Command:         command,
+							Args:            initArgs,
+							Image:           instance.Spec.ContainerImage,
+							SecurityContext: pod.RestrictiveSecurityContext(DnsmasqUID),
+							Env:             env.MergeEnvs([]corev1.EnvVar{}, envVars),
+							VolumeMounts:    getVolumeMounts(instance.Name, cms),
 						},
 					},
 					Containers: []corev1.Container{
 						{
-							Name:    ServiceName + "-dns",
-							Command: command,
-							Args:    args,
-							Image:   instance.Spec.ContainerImage,
-							SecurityContext: &corev1.SecurityContext{
-								RunAsNonRoot:             ptr.To(true),
-								AllowPrivilegeEscalation: ptr.To(false),
-								SeccompProfile: &corev1.SeccompProfile{
-									Type: corev1.SeccompProfileTypeRuntimeDefault,
-								},
-							},
-							Env:            env.MergeEnvs([]corev1.EnvVar{}, envVars),
-							VolumeMounts:   getVolumeMounts(instance.Name, cms),
-							ReadinessProbe: readinessProbe,
-							LivenessProbe:  livenessProbe,
+							Name:            ServiceName + "-dns",
+							Command:         command,
+							Args:            args,
+							Image:           instance.Spec.ContainerImage,
+							SecurityContext: pod.RestrictiveSecurityContext(DnsmasqUID),
+							Env:             env.MergeEnvs([]corev1.EnvVar{}, envVars),
+							VolumeMounts:    getVolumeMounts(instance.Name, cms),
+							ReadinessProbe:  readinessProbe,
+							LivenessProbe:   livenessProbe,
 						},
 					},
 					TerminationGracePeriodSeconds: &terminationGracePeriodSeconds,
diff --git a/internal/instanceha/funcs.go b/internal/instanceha/funcs.go
@@ -14,16 +14,17 @@ limitations under the License.
 package instanceha
 
 import (
+	"fmt"
+
 	instancehav1 "github.com/openstack-k8s-operators/infra-operator/apis/instanceha/v1beta1"
 	topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
 	env "github.com/openstack-k8s-operators/lib-common/modules/common/env"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/pod"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/serviceaccount"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
-
-	"fmt"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/utils/ptr"
 )
@@ -172,31 +173,25 @@ func Deployment(
 					Annotations: annotations,
 				},
 				Spec: corev1.PodSpec{
-					ServiceAccountName: instance.RbacResourceName(),
+					ServiceAccountName:           instance.RbacResourceName(),
+					AutomountServiceAccountToken: ptr.To(false),
 					SecurityContext: &corev1.PodSecurityContext{
 						FSGroup: ptr.To(instanceHaUID),
 					},
-					Volumes:                       volumes,
+					Volumes:                       append(volumes, serviceaccount.KubeAPIAccessVolume()),
 					TerminationGracePeriodSeconds: ptr.To[int64](45),
 					Containers: []corev1.Container{{
 						Name:    "instanceha",
 						Image:   containerImage,
 						Command: []string{"/usr/bin/python3", "-u", "/var/lib/instanceha/instanceha.py"},
-						SecurityContext: &corev1.SecurityContext{
-							RunAsUser:                ptr.To(instanceHaUID),
-							RunAsGroup:               ptr.To(instanceHaUID),
-							RunAsNonRoot:             ptr.To(true),
-							ReadOnlyRootFilesystem:   ptr.To(true),
-							AllowPrivilegeEscalation: ptr.To(false),
-							Capabilities: &corev1.Capabilities{
-								Drop: []corev1.Capability{
-									"ALL",
-								},
-							},
-						},
+						SecurityContext: func() *corev1.SecurityContext {
+							sc := pod.RestrictiveSecurityContext(instanceHaUID)
+							sc.ReadOnlyRootFilesystem = ptr.To(true)
+							return sc
+						}(),
 						Env:            env.MergeEnvs([]corev1.EnvVar{}, envVars),
 						Ports:          instancehaPorts(instance),
-						VolumeMounts:   volumeMounts,
+						VolumeMounts:   append(volumeMounts, serviceaccount.KubeAPIAccessVolumeMount()),
 						LivenessProbe:  livenessProbe,
 						ReadinessProbe: readinessProbe,
 					}},
diff --git a/internal/instanceha/funcs_test.go b/internal/instanceha/funcs_test.go
@@ -6,6 +6,7 @@ import (
 	. "github.com/onsi/gomega" //revive:disable:dot-imports
 
 	instancehav1 "github.com/openstack-k8s-operators/infra-operator/apis/instanceha/v1beta1"
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -101,6 +102,51 @@ func TestDeploymentSecurityContext(t *testing.T) {
 	g.Expect(container.SecurityContext.ReadOnlyRootFilesystem).NotTo(BeNil())
 	g.Expect(*container.SecurityContext.ReadOnlyRootFilesystem).To(BeTrue())
 
+	g.Expect(container.SecurityContext.RunAsNonRoot).NotTo(BeNil())
+	g.Expect(*container.SecurityContext.RunAsNonRoot).To(BeTrue())
+
+	g.Expect(container.SecurityContext.RunAsUser).NotTo(BeNil())
+	g.Expect(*container.SecurityContext.RunAsUser).To(Equal(int64(42401)))
+
+	g.Expect(container.SecurityContext.RunAsGroup).NotTo(BeNil())
+	g.Expect(*container.SecurityContext.RunAsGroup).To(Equal(int64(42401)))
+
+	g.Expect(container.SecurityContext.AllowPrivilegeEscalation).NotTo(BeNil())
+	g.Expect(*container.SecurityContext.AllowPrivilegeEscalation).To(BeFalse())
+
+	g.Expect(container.SecurityContext.Capabilities).NotTo(BeNil())
+	g.Expect(container.SecurityContext.Capabilities.Drop).To(ContainElement(corev1.Capability("ALL")))
+
+	g.Expect(container.SecurityContext.SeccompProfile).NotTo(BeNil())
+	g.Expect(container.SecurityContext.SeccompProfile.Type).To(Equal(corev1.SeccompProfileTypeRuntimeDefault))
+
+	// Verify AutomountServiceAccountToken is disabled
+	g.Expect(dep.Spec.Template.Spec.AutomountServiceAccountToken).NotTo(BeNil())
+	g.Expect(*dep.Spec.Template.Spec.AutomountServiceAccountToken).To(BeFalse())
+
+	// Verify kube-api-access projected volume exists
+	var kubeAPIVolumeFound bool
+	for _, vol := range dep.Spec.Template.Spec.Volumes {
+		if vol.Name == "kube-api-access" {
+			kubeAPIVolumeFound = true
+			g.Expect(vol.VolumeSource.Projected).NotTo(BeNil())
+			g.Expect(vol.VolumeSource.Projected.Sources).To(HaveLen(3))
+			break
+		}
+	}
+	g.Expect(kubeAPIVolumeFound).To(BeTrue(), "kube-api-access projected volume should exist")
+
+	// Verify kube-api-access mount exists
+	var kubeAPIMountFound bool
+	for _, mount := range container.VolumeMounts {
+		if mount.Name == "kube-api-access" && mount.MountPath == "/var/run/secrets/kubernetes.io/serviceaccount" {
+			kubeAPIMountFound = true
+			g.Expect(mount.ReadOnly).To(BeTrue())
+			break
+		}
+	}
+	g.Expect(kubeAPIMountFound).To(BeTrue(), "kube-api-access volume mount should exist")
+
 	// Verify /tmp emptyDir volume exists
 	var tmpVolumeFound bool
 	for _, vol := range dep.Spec.Template.Spec.Volumes {
diff --git a/internal/memcached/statefulset.go b/internal/memcached/statefulset.go
@@ -6,6 +6,7 @@ import (
 	common "github.com/openstack-k8s-operators/lib-common/modules/common"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/affinity"
 	labels "github.com/openstack-k8s-operators/lib-common/modules/common/labels"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/pod"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -63,15 +64,13 @@ func StatefulSet(
 					Labels: ls,
 				},
 				Spec: corev1.PodSpec{
-					ServiceAccountName: m.RbacResourceName(),
+					ServiceAccountName:           m.RbacResourceName(),
+					AutomountServiceAccountToken: ptr.To(false),
 					Containers: []corev1.Container{{
-						Image:   m.Spec.ContainerImage,
-						Name:    "memcached",
-						Command: []string{"/usr/bin/dumb-init", "--", "/usr/local/bin/kolla_start"},
-						SecurityContext: &corev1.SecurityContext{
-							RunAsUser:  ptr.To(MemcachedUID),
-							RunAsGroup: ptr.To(MemcachedUID),
-						},
+						Image:           m.Spec.ContainerImage,
+						Name:            "memcached",
+						Command:         []string{"/usr/bin/dumb-init", "--", "/usr/local/bin/kolla_start"},
+						SecurityContext: pod.RestrictiveSecurityContext(MemcachedUID),
 						Env: []corev1.EnvVar{{
 							Name:  "KOLLA_CONFIG_STRATEGY",
 							Value: "COPY_ALWAYS",
diff --git a/internal/redis/const.go b/internal/redis/const.go
diff --git a/internal/redis/statefulset.go b/internal/redis/statefulset.go
diff --git a/internal/redis/statefulset_test.go b/internal/redis/statefulset_test.go
diff --git a/test/functional/dnsmasq_controller_test.go b/test/functional/dnsmasq_controller_test.go

Original file line number	Diff line number	Diff line change
`@@ -24,4 +24,7 @@ const (`
`24`	`24`	`DNSPort int32 = 53`
`25`	`25`	`// DNSTargetPort - port used the service is listening on in the pod`
`26`	`26`	`DNSTargetPort int32 = 5353`
	`27`	`+`
	`28`	`+ // DnsmasqUID - https://github.com/openstack/kolla/blob/master/kolla/common/users.py`
	`29`	`+ DnsmasqUID int64 = 42435`
`27`	`30`	`)`