openstack/openstack-helm-infra
Code Issues Proposed changes

Add security context template to prometheus-blackbox-exporter

Browse Source 
This change adds security context template at pod level to implement
runAsUser flag

This change adds security context template at container level to implement
readOnly-fs flag

Change-Id: Icbea3487c058d88188061d0d5a77458dce910884
This commit is contained in:
KHIYANI, RAHUL (rk0850) 2020-08-24 17:14:57 -05:00 committed by Rahul Khiyani
parent f29707dea2
commit 98dbc6dfef
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
prometheus-blackbox-exporter/templates/deployment.yaml
View File

@ -34,12 +34,14 @@ spec:
annotations:
{{ dict "envAll" $envAll "podName" "prometheus-blackbox-exporter" "containerNames" (list "blackbox-exporter") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "prometheus_blackbox_exporter" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
nodeSelector:
{{ .Values.labels.blackbox_exporter.node_selector_key }}: {{ .Values.labels.blackbox_exporter.node_selector_value | quote }}
containers:
- name: blackbox-exporter
{{ tuple $envAll "prometheus_blackbox_exporter" | include "helm-toolkit.snippets.image" | indent 8 }}
{{ tuple $envAll $envAll.Values.pod.resources.prometheus_blackbox_exporter | include "helm-toolkit.snippets.kubernetes_resources" | indent 8 }}
{{ dict "envAll" $envAll "application" "prometheus_blackbox_exporter" "container" "blackbox_exporter" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 8 }}
args:
- "--config.file=/config/blackbox.yaml"
ports:

8
prometheus-blackbox-exporter/values.yaml
View File

@ -47,6 +47,14 @@ endpoints:
default: 9115
pod:
security_context:
prometheus_blackbox_exporter:
pod:
runAsUser: 65534
container:
blackbox_exporter:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
replicas:
prometheus_blackbox_exporter: 1
annotations: