openstack/openstack-helm-infra
Code Issues Proposed changes

prometheus: Fix security context

Browse Source 
This PS fixes the use of the security context macros for the
prometheus chart.

Change-Id: I0abb309132a9954a140cbf76463724c5e2c7c5f3
This commit is contained in:
RAHUL KHIYANI 2019-04-22 12:21:31 -05:00 committed by Rahul Khiyani
parent 95bb125207
commit 916bdabee7
2 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
prometheus/templates/statefulset.yaml
View File

@ -88,7 +88,7 @@ spec:
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
spec: spec:
{{ dict "envAll" $envAll "application" "prometheus" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} {{ dict "envAll" $envAll "application" "api" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
affinity: affinity:
{{ tuple $envAll "prometheus" "api" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} {{ tuple $envAll "prometheus" "api" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -100,7 +100,7 @@ spec:
- name: prometheus-perms - name: prometheus-perms
{{ tuple $envAll "prometheus" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll "prometheus" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.prometheus | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.prometheus | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "prometheus" "container" "prometheus_perms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} {{ dict "envAll" $envAll "application" "api" "container" "prometheus_perms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
command: command:
- chown - chown
- -R - -R
@ -115,7 +115,7 @@ spec:
- name: apache-proxy - name: apache-proxy
{{ tuple $envAll "apache_proxy" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll "apache_proxy" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.apache_proxy | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.apache_proxy | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "prometheus" "container" "apache_proxy" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} {{ dict "envAll" $envAll "application" "api" "container" "apache_proxy" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
command: command:
- /tmp/apache.sh - /tmp/apache.sh
- start - start
@ -149,7 +149,7 @@ spec:
- name: prometheus - name: prometheus
{{ tuple $envAll "prometheus" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll "prometheus" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.prometheus | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.prometheus | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "prometheus" "container" "prometheus" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} {{ dict "envAll" $envAll "application" "api" "container" "prometheus" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
command: command:
- /tmp/prometheus.sh - /tmp/prometheus.sh
- start - start

4
prometheus/values.yaml
View File

@ -44,14 +44,16 @@ labels:
pod: pod:
security_context: security_context:
prometheus: api:
pod: pod:
runAsUser: 65534 runAsUser: 65534
container: container:
prometheus_perms: prometheus_perms:
runAsUser: 0 runAsUser: 0
readOnlyRootFilesystem: false
apache_proxy: apache_proxy:
runAsUser: 0 runAsUser: 0
readOnlyRootFilesystem: false
prometheus: prometheus:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
readOnlyRootFilesystem: true readOnlyRootFilesystem: true