Merge "Add missing security context to elasticsearch pods/containers"

elasticsearch/templates/cron-job-curator.yaml

@@ -38,6 +38,7 @@ spec:
       labels:
 {{ tuple $envAll "elasticsearch" "curator" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
     spec:
+{{ dict "envAll" $envAll "application" "curator" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
       template:
         metadata:
           labels:
@@ -53,6 +54,7 @@ spec:
             - name: curator
 {{ tuple $envAll "curator" | include "helm-toolkit.snippets.image" | indent 14 }}
 {{ tuple $envAll $envAll.Values.pod.resources.jobs.curator | include "helm-toolkit.snippets.kubernetes_resources" | indent 14 }}
+{{ dict "envAll" $envAll "application" "curator" "container" "curator" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 14 }}
               command:
                 - /tmp/curator.sh
               env:

elasticsearch/templates/cron-job-verify-repositories.yaml

@@ -40,6 +40,7 @@ spec:
       annotations:
 {{ dict "envAll" $envAll "podName" "elasticsearch-verify-repositories" "containerNames" (list "elasticsearch-verify-repositories" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
+{{ dict "envAll" $envAll "application" "verify_repositories" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
       template:
         metadata:
           labels:
@@ -55,6 +56,7 @@ spec:
             - name: elasticsearch-verify-repositories
 {{ tuple $envAll "snapshot_repository" | include "helm-toolkit.snippets.image" | indent 14 }}
 {{ tuple $envAll $envAll.Values.pod.resources.jobs.snapshot_repository | include "helm-toolkit.snippets.kubernetes_resources" | indent 14 }}
+{{ dict "envAll" $envAll "application" "verify_repositories" "container" "elasticsearch_verify_repositories" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 14 }}
               command:
                 - /tmp/verify-repositories.sh
               env:

elasticsearch/templates/job-elasticsearch-template.yaml

@@ -36,7 +36,7 @@ spec:
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
 {{ dict "envAll" $envAll "podName" "create-elasticsearch-templates" "containerNames" (list "create-elasticsearch-templates" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
-{{ dict "envAll" $envAll "application" "elasticsearch_template" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
+{{ dict "envAll" $envAll "application" "create_template" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
       serviceAccountName: {{ $serviceAccountName }}
       restartPolicy: OnFailure
       nodeSelector:
@@ -47,7 +47,7 @@ spec:
         - name: create-elasticsearch-templates
 {{ tuple $envAll "elasticsearch_templates" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.jobs.elasticsearch_templates | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
-{{ dict "envAll" $envAll "application" "elasticsearch_template" "container" "elasticsearch_template" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
+{{ dict "envAll" $envAll "application" "create_template" "container" "create_elasticsearch_template" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           env:
             - name: ELASTICSEARCH_HOST
               value: {{ tuple "elasticsearch" "internal" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" | quote }}

elasticsearch/values.yaml

@@ -243,6 +243,24 @@ pod:
               - IPC_LOCK
               - SYS_RESOURCE
           readOnlyRootFilesystem: false
+    curator:
+      pod:
+        runAsUser: 0
+      container:
+        curator:
+          readOnlyRootFilesystem: true
+    verify_repositories:
+      pod:
+        runAsUser: 0
+      container:
+        elasticsearch_verify_repositories:
+          readOnlyRootFilesystem: true
+    create_template:
+      pod:
+        runAsUser: 0
+      container:
+        create_elasticsearch_template:
+          readOnlyRootFilesystem: true
   affinity:
     anti:
       type: