airship
/
promenade
Code Issues Proposed changes

Merge "Scheduler: Add pod/container security context"

This commit is contained in:
Zuul 2019-11-07 20:13:54 +00:00 committed by Gerrit Code Review
parent eacecb7918 6079fa7755
commit 546929476a
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
charts/scheduler/templates/sched-anchor.yaml
View File

@ -40,6 +40,7 @@ spec:
labels: labels:
{{ $labels | indent 8 }} {{ $labels | indent 8 }}
spec: spec:
{{ dict "envAll" $envAll "application" "scheduler" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
hostNetwork: true hostNetwork: true
dnsPolicy: {{ .Values.anchor.dns_policy }} dnsPolicy: {{ .Values.anchor.dns_policy }}
nodeSelector: nodeSelector:
@ -55,6 +56,7 @@ spec:
image: {{ .Values.images.tags.anchor }} image: {{ .Values.images.tags.anchor }}
imagePullPolicy: {{ .Values.images.pull_policy }} imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.anchor_daemonset | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.anchor_daemonset | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "scheduler" "container" "anchor" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
command: command:
- /tmp/bin/anchor - /tmp/bin/anchor
lifecycle: lifecycle:

8
charts/scheduler/values.yaml
View File

@ -25,6 +25,14 @@ labels:
node_selector_value: enabled node_selector_value: enabled
pod: pod:
security_context:
scheduler:
pod:
runAsUser: 65534
container:
anchor:
runAsUser: 0
readOnlyRootFilesystem: true
lifecycle: lifecycle:
upgrades: upgrades:
daemonsets: daemonsets: