From cce2e61c16b1e36c14c3f8b299862408bee8717b Mon Sep 17 00:00:00 2001
From: "KHIYANI, RAHUL (rk0850)" <rk0850@att.com>
Date: Thu, 13 Feb 2020 10:51:15 -0600
Subject: [PATCH] Add Docker default AppArmor profile to memcached chart

Adding apparmor profile to memcached and memcached-exporter charts

Change-Id: I40ece825d75b6884714b9121d8d501efcbce2f53
---
 memcached/templates/deployment.yaml                        | 2 +-
 .../monitoring/prometheus/exporter-deployment.yaml         | 4 ++++
 memcached/values_overrides/apparmor.yaml                   | 7 +++++++
 3 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 memcached/values_overrides/apparmor.yaml

diff --git a/memcached/templates/deployment.yaml b/memcached/templates/deployment.yaml
index a361b2670..fb300e7d5 100644
--- a/memcached/templates/deployment.yaml
+++ b/memcached/templates/deployment.yaml
@@ -39,7 +39,7 @@ spec:
   template:
     metadata:
       annotations:
-{{- dict "envAll" $envAll "podName" "memcached" "containerNames" (list "apparmor-loader" "memcached") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
+{{ dict "envAll" $envAll "podName" "memcached" "containerNames" (list "memcached") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
       labels:
diff --git a/memcached/templates/monitoring/prometheus/exporter-deployment.yaml b/memcached/templates/monitoring/prometheus/exporter-deployment.yaml
index 549a56779..11eec254c 100644
--- a/memcached/templates/monitoring/prometheus/exporter-deployment.yaml
+++ b/memcached/templates/monitoring/prometheus/exporter-deployment.yaml
@@ -39,6 +39,10 @@ spec:
       labels:
 {{ tuple $envAll "prometheus_memcached_exporter" "exporter" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
       namespace: {{ .Values.endpoints.prometheus_memcached_exporter.namespace }}
+      annotations:
+{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
+        configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
+{{ dict "envAll" $envAll "podName" "prometheus_memcached_exporter" "containerNames" (list "memcached-exporter") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
 {{ dict "envAll" $envAll "application" "memcached_exporter" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
       shareProcessNamespace: true
diff --git a/memcached/values_overrides/apparmor.yaml b/memcached/values_overrides/apparmor.yaml
new file mode 100644
index 000000000..85a9fe86b
--- /dev/null
+++ b/memcached/values_overrides/apparmor.yaml
@@ -0,0 +1,7 @@
+pod:
+  mandatory_access_control:
+    type: apparmor
+    prometheus_memcached_exporter:
+      memcached-exporter: runtime/default
+    memcached:
+      memcached: runtime/default