airship
/
promenade
Code Issues Proposed changes

Proxy: Add pod/container security context 

This updates the proxy chart to include the pod
security context on the pod template.

This also adds the container security context to set
readOnlyRootFilesystem flag to false

Change-Id: I4e6d2836aa9d548118937b6b176e06fbc4a8c7ee
This commit is contained in:
KHIYANI, RAHUL (rk0850) 2019-10-31 23:05:19 -05:00 committed by Rahul Khiyani
parent fd1ff8444d
commit d850c36afa
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
charts/proxy/templates/daemonset.yaml
View File

@ -39,6 +39,7 @@ spec:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
scheduler.alpha.kubernetes.io/critical-pod: '' scheduler.alpha.kubernetes.io/critical-pod: ''
spec: spec:
{{ dict "envAll" $envAll "application" "proxy" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
hostNetwork: true hostNetwork: true
shareProcessNamespace: true shareProcessNamespace: true
dnsPolicy: Default dnsPolicy: Default
@ -63,8 +64,7 @@ spec:
- --v={{ .Values.proxy.logging.log_level }} - --v={{ .Values.proxy.logging.log_level }}
{{- end }} {{- end }}
{{ tuple $envAll $envAll.Values.pod.resources.proxy | include "helm-toolkit.snippets.kubernetes_resources" | indent 8 }} {{ tuple $envAll $envAll.Values.pod.resources.proxy | include "helm-toolkit.snippets.kubernetes_resources" | indent 8 }}
securityContext: {{ dict "envAll" $envAll "application" "proxy" "container" "proxy" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 8 }}
privileged: true
env: env:
- name: KUBERNETES_SERVICE_HOST - name: KUBERNETES_SERVICE_HOST
value: {{ .Values.kube_service.host }} value: {{ .Values.kube_service.host }}

9
charts/proxy/values.yaml
View File

@ -18,6 +18,15 @@ manifests:
rbac: true rbac: true
pod: pod:
security_context:
proxy:
pod:
runAsUser: 65534
container:
proxy:
runAsUser: 0
privileged: true
readOnlyRootFilesystem: false
lifecycle: lifecycle:
upgrades: upgrades:
daemonsets: daemonsets: