openstack/openstack-helm-infra
Code Issues Proposed changes

Kubernetes-keystone-webhook: Add security context

Browse Source 
This adds the security context to the
kubernetes-keystone-webhook. This changes the default
user from root to the nobody user.
This also adds the container security context to
explicitly set allowPrivilegeEscalation to false

Change-Id: I54621e94f2866a4b4301baa6b570472c5fcda291
This commit is contained in:
Gupta, Sangeet (sg774j) 2019-02-21 15:58:51 -06:00
parent b8b72d7e16
commit b1d0fd3699
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
kubernetes-keystone-webhook/templates/deployment.yaml
View File

@ -38,10 +38,13 @@ spec:
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
spec: spec:
{{ dict "envAll" $envAll "application" "kubernetes-keystone-webhook" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
containers: containers:
- name: kubernetes-keystone-webhook - name: kubernetes-keystone-webhook
{{ tuple $envAll "kubernetes_keystone_webhook" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll "kubernetes_keystone_webhook" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.server | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.server | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
securityContext:
allowPrivilegeEscalation: false
command: command:
- /tmp/start.sh - /tmp/start.sh
readinessProbe: readinessProbe:

3
kubernetes-keystone-webhook/values.yaml
View File

@ -49,6 +49,9 @@ network:
port: 30601 port: 30601
pod: pod:
user:
kubernetes-keystone-webhook:
uid: 65534
affinity: affinity:
anti: anti:
type: type: