airship
/
promenade
Code Issues Proposed changes

Add security context template for etcd-backup chart 

This change also removes etcd-perms container which is not required

Change-Id: Ia6c38424e0c2d177e35fc904a9551d601a31ac3b
This commit is contained in:
KHIYANI, RAHUL (rk0850) 2020-07-22 12:20:56 -05:00 committed by Rahul Khiyani
parent ddde579dd9
commit fffb57109d
2 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
charts/etcd/templates/cron-job-etcd-backup.yaml
View File

@ -78,6 +78,7 @@ spec:
annotations:
{{ dict "envAll" $envAll "podName" "etcd-backup" "containerNames" (list "etcd-backup") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 4 }}
spec:
{{ dict "envAll" $envAll "application" "etcd_backup" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
template:
spec:
serviceAccountName: {{ .Values.service.name }}-{{ $serviceAccountName }}
@ -89,6 +90,7 @@ spec:
image: {{ .Values.images.tags.etcdctl_backup }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.jobs.etcd_backup | include "helm-toolkit.snippets.kubernetes_resources" | indent 14 }}
{{ dict "envAll" $envAll "application" "etcd_backup" "container" "etcd_backup" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 14 }}
env:
- name: ETCDCTL_API
value: "{{ .Values.etcd.etcdctl_api }}"

8
charts/etcd/values.yaml
View File

@ -178,13 +178,9 @@ pod:
pod:
runAsUser: 65534
container:
backup_perms:
runAsUser: 0
readOnlyRootFilesystem: true
etcd_backup:
runAsUser: 65534
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
runAsUser: 0
readOnlyRootFilesystem: false
etcd:
pod:
runAsUser: 65534