OpenvSwitch: use security context macros
This PS updates to use security context macros from HTK, in line with other charts. Change-Id: I5ca0af17eccc4856baef871cf199554aad075ebe Signed-off-by: Pete Birley <pete@port.direct>
This commit is contained in:
parent
d83ab26d04
commit
358af71da7
@ -43,6 +43,7 @@ spec:
|
|||||||
spec:
|
spec:
|
||||||
shareProcessNamespace: true
|
shareProcessNamespace: true
|
||||||
serviceAccountName: {{ $serviceAccountName }}
|
serviceAccountName: {{ $serviceAccountName }}
|
||||||
|
{{ dict "envAll" $envAll "application" "openvswitch_db_server" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
|
||||||
nodeSelector:
|
nodeSelector:
|
||||||
{{ .Values.labels.ovs.node_selector_key }}: {{ .Values.labels.ovs.node_selector_value }}
|
{{ .Values.labels.ovs.node_selector_key }}: {{ .Values.labels.ovs.node_selector_value }}
|
||||||
dnsPolicy: ClusterFirstWithHostNet
|
dnsPolicy: ClusterFirstWithHostNet
|
||||||
@ -51,15 +52,12 @@ spec:
|
|||||||
{{ tuple $envAll "db" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
|
{{ tuple $envAll "db" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
|
||||||
- name: openvswitch-db-perms
|
- name: openvswitch-db-perms
|
||||||
{{ tuple $envAll "openvswitch_db_server" | include "helm-toolkit.snippets.image" | indent 10 }}
|
{{ tuple $envAll "openvswitch_db_server" | include "helm-toolkit.snippets.image" | indent 10 }}
|
||||||
|
{{ dict "envAll" $envAll "application" "openvswitch_db_server" "container" "perms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
|
||||||
{{ tuple $envAll $envAll.Values.pod.resources.ovs.db | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
{{ tuple $envAll $envAll.Values.pod.resources.ovs.db | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
||||||
securityContext:
|
|
||||||
runAsUser: 0
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
command:
|
command:
|
||||||
- chown
|
- chown
|
||||||
- -R
|
- -R
|
||||||
- "42424:42424"
|
- {{ $envAll.Values.pod.security_context.openvswitch_db_server.container.server.runAsUser | quote }}
|
||||||
- /run/openvswitch
|
- /run/openvswitch
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- name: pod-tmp
|
- name: pod-tmp
|
||||||
@ -69,11 +67,8 @@ spec:
|
|||||||
containers:
|
containers:
|
||||||
- name: openvswitch-db
|
- name: openvswitch-db
|
||||||
{{ tuple $envAll "openvswitch_db_server" | include "helm-toolkit.snippets.image" | indent 10 }}
|
{{ tuple $envAll "openvswitch_db_server" | include "helm-toolkit.snippets.image" | indent 10 }}
|
||||||
|
{{ dict "envAll" $envAll "application" "openvswitch_db_server" "container" "server" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
|
||||||
{{ tuple $envAll $envAll.Values.pod.resources.ovs.db | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
{{ tuple $envAll $envAll.Values.pod.resources.ovs.db | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
||||||
securityContext:
|
|
||||||
runAsUser: 42424
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
exec:
|
exec:
|
||||||
command:
|
command:
|
||||||
|
@ -43,6 +43,7 @@ spec:
|
|||||||
spec:
|
spec:
|
||||||
shareProcessNamespace: true
|
shareProcessNamespace: true
|
||||||
serviceAccountName: {{ $serviceAccountName }}
|
serviceAccountName: {{ $serviceAccountName }}
|
||||||
|
{{ dict "envAll" $envAll "application" "openvswitch_vswitchd" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
|
||||||
nodeSelector:
|
nodeSelector:
|
||||||
{{ .Values.labels.ovs.node_selector_key }}: {{ .Values.labels.ovs.node_selector_value }}
|
{{ .Values.labels.ovs.node_selector_key }}: {{ .Values.labels.ovs.node_selector_value }}
|
||||||
dnsPolicy: ClusterFirstWithHostNet
|
dnsPolicy: ClusterFirstWithHostNet
|
||||||
@ -51,11 +52,7 @@ spec:
|
|||||||
{{ tuple $envAll "vswitchd" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
|
{{ tuple $envAll "vswitchd" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
|
||||||
- name: openvswitch-vswitchd-modules
|
- name: openvswitch-vswitchd-modules
|
||||||
{{ tuple $envAll "openvswitch_vswitchd" | include "helm-toolkit.snippets.image" | indent 10 }}
|
{{ tuple $envAll "openvswitch_vswitchd" | include "helm-toolkit.snippets.image" | indent 10 }}
|
||||||
securityContext:
|
{{ dict "envAll" $envAll "application" "openvswitch_vswitchd" "container" "modules" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
|
||||||
capabilities:
|
|
||||||
add:
|
|
||||||
- SYS_MODULE
|
|
||||||
runAsUser: 0
|
|
||||||
command:
|
command:
|
||||||
- /tmp/openvswitch-vswitchd-init-modules.sh
|
- /tmp/openvswitch-vswitchd-init-modules.sh
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
@ -71,12 +68,8 @@ spec:
|
|||||||
containers:
|
containers:
|
||||||
- name: openvswitch-vswitchd
|
- name: openvswitch-vswitchd
|
||||||
{{ tuple $envAll "openvswitch_vswitchd" | include "helm-toolkit.snippets.image" | indent 10 }}
|
{{ tuple $envAll "openvswitch_vswitchd" | include "helm-toolkit.snippets.image" | indent 10 }}
|
||||||
|
{{ dict "envAll" $envAll "application" "openvswitch_vswitchd" "container" "vswitchd" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
|
||||||
{{ tuple $envAll $envAll.Values.pod.resources.ovs.vswitchd | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
{{ tuple $envAll $envAll.Values.pod.resources.ovs.vswitchd | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
||||||
securityContext:
|
|
||||||
runAsUser: 0
|
|
||||||
capabilities:
|
|
||||||
add:
|
|
||||||
- NET_ADMIN
|
|
||||||
# ensures this container can speak to the ovs database
|
# ensures this container can speak to the ovs database
|
||||||
# successfully before its marked as ready
|
# successfully before its marked as ready
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
|
@ -38,6 +38,33 @@ labels:
|
|||||||
node_selector_value: enabled
|
node_selector_value: enabled
|
||||||
|
|
||||||
pod:
|
pod:
|
||||||
|
security_context:
|
||||||
|
openvswitch_db_server:
|
||||||
|
pod:
|
||||||
|
runAsUser: 42424
|
||||||
|
container:
|
||||||
|
perms:
|
||||||
|
runAsUser: 0
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
server:
|
||||||
|
runAsUser: 42424
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
openvswitch_vswitchd:
|
||||||
|
pod:
|
||||||
|
runAsUser: 0
|
||||||
|
container:
|
||||||
|
modules:
|
||||||
|
runAsUser: 0
|
||||||
|
capabilities:
|
||||||
|
add:
|
||||||
|
- SYS_MODULE
|
||||||
|
vswitchd:
|
||||||
|
runAsUser: 0
|
||||||
|
capabilities:
|
||||||
|
add:
|
||||||
|
- NET_ADMIN
|
||||||
lifecycle:
|
lifecycle:
|
||||||
upgrades:
|
upgrades:
|
||||||
daemonsets:
|
daemonsets:
|
||||||
|
Loading…
Reference in New Issue
Block a user