airship/deckhand
Code Issues Proposed changes

Merge "Implement Security Context for Deckhand"

Browse Source
This commit is contained in:
Zuul 2019-04-19 14:14:41 +00:00 committed by Gerrit Code Review
commit 81b2badca5
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
charts/deckhand/templates/deployment.yaml
View File

@ -39,6 +39,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
spec: spec:
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
{{ dict "envAll" $envAll "application" "deckhand" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
nodeSelector: nodeSelector:
{{ .Values.labels.api.node_selector_key }}: {{ .Values.labels.api.node_selector_value }} {{ .Values.labels.api.node_selector_key }}: {{ .Values.labels.api.node_selector_value }}
terminationGracePeriodSeconds: {{ .Values.pod.lifecycle.termination_grace_period.deckhand.timeout | default "30" }} terminationGracePeriodSeconds: {{ .Values.pod.lifecycle.termination_grace_period.deckhand.timeout | default "30" }}
@ -62,6 +63,7 @@ spec:
image: {{ .Values.images.tags.deckhand }} image: {{ .Values.images.tags.deckhand }}
imagePullPolicy: {{ .Values.images.pull_policy }} imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "deckhand" "container" "deckhand_api" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
ports: ports:
- containerPort: {{ tuple "deckhand" "internal" "api" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} - containerPort: {{ tuple "deckhand" "internal" "api" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
livenessProbe: livenessProbe:

8
charts/deckhand/values.yaml
View File

@ -325,6 +325,14 @@ conf:
formatter_simple: formatter_simple:
format: "%(asctime)s.%(msecs)03d %(process)d %(levelname)s: %(message)s" format: "%(asctime)s.%(msecs)03d %(process)d %(levelname)s: %(message)s"
pod: pod:
security_context:
deckhand:
pod:
runAsUser: 65534
container:
deckhand_api:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
mounts: mounts:
deckhand_db_init: deckhand_db_init:
init_container: null init_container: null