openstack/openstack-helm-infra
Code Issues Proposed changes

Calico-etcd: Add pod/container security context

Browse Source 
This updates the Calico-etcd chart to include the pod
security context on the pod template

This also adds the container security context to set
readOnlyRootFilesystem to true

Change-Id: I10ff398d7a552d5287d841ca39c77ea097f7e67e
This commit is contained in:
Rahul Khiyani 2019-03-13 10:40:39 -04:00 committed by Steve Wilkerson
parent d738cd5e91
commit 4f59603879
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
calico/templates/daemonset-calico-etcd.yaml
View File

@ -51,8 +51,7 @@ spec:
# a failure. This annotation works in tandem with the toleration below. # a failure. This annotation works in tandem with the toleration below.
scheduler.alpha.kubernetes.io/critical-pod: '' scheduler.alpha.kubernetes.io/critical-pod: ''
spec: spec:
securityContext: {{ dict "envAll" $envAll "application" "calico" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
readOnlyRootFilesystem: true
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
tolerations: tolerations:
# This taint is set by all kubelets running `--cloud-provider=external` # This taint is set by all kubelets running `--cloud-provider=external`
@ -77,6 +76,7 @@ spec:
- name: calico-etcd - name: calico-etcd
{{ tuple $envAll "calico_etcd" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll "calico_etcd" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.calico_etcd | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.calico_etcd | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "calico" "container" "calico_etcd" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env: env:
- name: CALICO_ETCD_IP - name: CALICO_ETCD_IP
valueFrom: valueFrom:

7
calico/values.yaml
View File

@ -37,6 +37,13 @@ images:
- calico_kube_controllers - calico_kube_controllers
pod: pod:
security_context:
calico:
pod:
runAsUser: 0
container:
calico_etcd:
readOnlyRootFilesystem: true
resources: resources:
enabled: false enabled: false
jobs: jobs: