Run apiserver-webhook containers with the 'nobody' user
The apiserver-webhook containers should run with a non-root user when possible Change-Id: Ia56794e4f39423cbb642c3aa518649abc2a51d5c
This commit is contained in:
parent
9b62a49eae
commit
6fcdde451b
|
@ -118,6 +118,7 @@ spec:
|
||||||
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
|
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
spec:
|
spec:
|
||||||
dnsPolicy: ClusterFirst
|
dnsPolicy: ClusterFirst
|
||||||
|
{{ dict "envAll" $envAll "application" "apiserver_webhook" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
|
||||||
containers:
|
containers:
|
||||||
- name: apiserver
|
- name: apiserver
|
||||||
image: {{ .Values.images.tags.apiserver }}
|
image: {{ .Values.images.tags.apiserver }}
|
||||||
|
|
|
@ -247,6 +247,10 @@ pod:
|
||||||
kubernetes_keystone_webhook_tests:
|
kubernetes_keystone_webhook_tests:
|
||||||
init_container: null
|
init_container: null
|
||||||
kubernetes_keystone_webhook_tests: null
|
kubernetes_keystone_webhook_tests: null
|
||||||
|
security_context:
|
||||||
|
apiserver_webhook:
|
||||||
|
pod:
|
||||||
|
runAsUser: 65534
|
||||||
conf:
|
conf:
|
||||||
paths:
|
paths:
|
||||||
base: '/etc/webhook_apiserver/'
|
base: '/etc/webhook_apiserver/'
|
||||||
|
|
Loading…
Reference in New Issue