# Kustomize patch securityContext of all containers within deployments/staefulset

**URL:** <https://discuss.kubernetes.io/t/kustomize-patch-securitycontext-of-all-containers-within-deployments-staefulset/28920>\
**Category:** General Discussions\
**Created:** [July 8, 2024, 5:53am UTC](https://discuss.kubernetes.io/t/kustomize-patch-securitycontext-of-all-containers-within-deployments-staefulset/28920 "2024-07-08T05:53:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tzabbi](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/tzabbi/32/15316_2.png) [@tzabbi](https://discuss.kubernetes.io/u/tzabbi)\
**Post date:** [July 8, 2024, 5:53am UTC](https://discuss.kubernetes.io/t/kustomize-patch-securitycontext-of-all-containers-within-deployments-staefulset/28920/1 "2024-07-08T05:53:31Z")

</div>

Asking for help? Comment out what you need so we can get more information to help you!

### Cluster information:

Kubernetes version: 1.27.10  
Cloud being used: bare-metal  
Installation method: Rancher  
Host OS: RHEL  
CNI and version: Calico  
CRI and version: Cri-o

You can format your yaml by highlighting it and pressing Ctrl-Shift-C, it will make your output easier to read.

First of all my background: I know Kubernetes really well but not kustomize.

My question is how to patch every container in all deployments/statefulsets via kustomize. Specially I want to update the securityContext of these with the following values:

```yaml
"allowPrivilegeEscalation": false
capabilities:
        drop:
          - ALL

```

This is needed because our customer introduced this kind of security mechanism.  
I want to install Kubeflow which has a lot of deployments and sts. (This is the reason I use Kustomize)

I use the latest Kustomize version.

Currently i tried it with json patch:

```json
[
  {
    "op": "add",
    "path": "/spec/template/spec/containers/*/securityContext",
    "value": {
      "allowPrivilegeEscalation": false
    }
  }
]

```

and

```json
[
  {
    "op": "add",
    "path": "/spec/template/spec/containers/*/securityContext/capabilities/drop",
    "value": ["ALL"]
  }
]

```

But this does not work.

Can someone help me?

PS: If something with this topic is wrong, please tell me. My first post.

Thanks to everyone who is willing to help me, I really appreciate all of you!

---

<div class="post-metadata">

**Author:** ![Michael\_Jones](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/michael_jones/32/15368_2.png) [@Michael\_Jones](https://discuss.kubernetes.io/u/Michael_Jones)\
**Post date:** [July 13, 2024, 12:02pm UTC](https://discuss.kubernetes.io/t/kustomize-patch-securitycontext-of-all-containers-within-deployments-staefulset/28920/2 "2024-07-13T12:02:21Z")

</div>

I tried doing the same thing for allowPrivilegeEscalation, found patch does not support wildcard, only containers/0/sec…, containers/1/sec…

replace does allow wild card, but that doesn’t meet the needs either as we’d need a valid source…

---

<div class="post-metadata">

**Author:** ![Michael\_Jones](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/michael_jones/32/15368_2.png) [@Michael\_Jones](https://discuss.kubernetes.io/u/Michael_Jones)\
**Post date:** [July 13, 2024, 12:11pm UTC](https://discuss.kubernetes.io/t/kustomize-patch-securitycontext-of-all-containers-within-deployments-staefulset/28920/3 "2024-07-13T12:11:10Z")

</div>

just had an idea, and tested it;

1. patch pod 0
2. replace all using that pod as source

it works…

main kustomize:

```auto
...
patches:
- path: security-patches/ks-explicitPrivilege.yaml
  target:
    kind: Deployment
replacements:
  - path: security-patches/replace-explicitPrivilege.yaml 

```

patch file for pod 0 in all deployment:

```auto
- op: replace
  path: /spec/template/spec/containers/0/securityContext/privileged
  value: false

```

replace file for ALL containers based off pod 0

```auto
---
source: 
  kind: Deployment
  name: **[YOUR_DEPLOYMENT_NAME]**
  fieldPath: spec.template.spec.containers.0.securityContext.privileged
targets:
- select:
    kind: Deployment
  fieldPaths: 
  - spec.template.spec.containers.*.securityContext.privileged
  options:
    create: true

```

only part not generic is;

- YOUR\_DEPLOYMENT\_NAME

⚠ best practice would be to edit the base files instead of patch them, but the patch/replace is still useful.

---

<div class="post-metadata">

**Author:** ![tzabbi](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/tzabbi/32/15316_2.png) [@tzabbi](https://discuss.kubernetes.io/u/tzabbi)\
**Post date:** [July 17, 2024, 5:41am UTC](https://discuss.kubernetes.io/t/kustomize-patch-securitycontext-of-all-containers-within-deployments-staefulset/28920/4 "2024-07-17T05:41:27Z")

</div>

We fixed it with a replacsement in json format

… containers/\*/…

---

<div class="post-metadata">

**Author:** ![tzabbi](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/tzabbi/32/15316_2.png) [@tzabbi](https://discuss.kubernetes.io/u/tzabbi)\
**Post date:** [July 17, 2024, 5:42am UTC](https://discuss.kubernetes.io/t/kustomize-patch-securitycontext-of-all-containers-within-deployments-staefulset/28920/5 "2024-07-17T05:42:27Z")

</div>

Your solution also works thanks 🙂

---

<div class="post-metadata">

**Author:** ![Ricardo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/ricardo/32/17949_2.png) [@Ricardo](https://discuss.kubernetes.io/u/Ricardo)\
**Post date:** [December 29, 2025, 12:24am UTC](https://discuss.kubernetes.io/t/kustomize-patch-securitycontext-of-all-containers-within-deployments-staefulset/28920/6 "2025-12-29T00:24:43Z")

</div>

Another example of Kustomize using an embedded JSON6902 patch:

```auto
patches:
- target:
    kind: Deployment
    name: api-deployment
  patch: |-
    - op: replace
      path: /spec/template/spec/containers/0/image
      value: nginx

```