openstack/openstack-helm
Code Issues Proposed changes

Add Apparmor for Missing containers for glance and neutron pods

Browse Source 
1)Fixed nginx container in glance.
2)Fixed rpc server in neutron.
3)Enabled Certificates for creating pods.

Change-Id: Ida510ee22808b818e256f93b11d2e1ed36f63a19
Signed-off-by: diwakar thyagaraj <diwakar.chitoor.thyagaraj@att.com>
This commit is contained in:
diwakar thyagaraj 2020-08-27 15:29:05 +00:00
parent 71bc6d15c7
commit 9c39f2e328
5 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
glance/templates/deployment-api.yaml
View File

@ -43,7 +43,7 @@ spec:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "glance-api" "containerNames" ( list "glance-perms" "glance-api" "init" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
{{ dict "envAll" $envAll "podName" "glance-api" "containerNames" ( list "glance-perms" "glance-api" "init" "nginx" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
serviceAccountName: {{ $serviceAccountName }}
{{ dict "envAll" $envAll "application" "glance" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}

2
glance/templates/deployment-registry.yaml
View File

@ -43,7 +43,7 @@ spec:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "glance-registry" "containerNames" ( list "glance-registry" "init" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
{{ dict "envAll" $envAll "podName" "glance-registry" "containerNames" ( list "glance-registry" "init" "nginx" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
serviceAccountName: {{ $serviceAccountName }}
{{ dict "envAll" $envAll "application" "glance" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}

3
glance/values_overrides/apparmor.yaml
View File

@ -6,9 +6,11 @@ pod:
glance-api: runtime/default
glance-perms: runtime/default
init: runtime/default
nginx: runtime/default
glance-registry:
glance-registry: runtime/default
init: runtime/default
nginx: runtime/default
glance-metadefs-load:
init: runtime/default
glance-metadefs-load: runtime/default
@ -21,4 +23,5 @@ pod:
glance-test-ks-user: runtime/default
manifests:
deployment_registry: true
certificates: true
...

2
neutron/templates/deployment-server.yaml
View File

@ -55,7 +55,7 @@ spec:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "neutron-server" "containerNames" (list "neutron-server" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
{{ dict "envAll" $envAll "podName" "neutron-server" "containerNames" (list "neutron-server" "init" "neutron-rpc-server") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "neutron_server" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}

3
neutron/values_overrides/apparmor.yaml
View File

@ -31,8 +31,11 @@ pod:
neutron-server:
neutron-server: runtime/default
init: runtime/default
neutron-rpc-server: runtime/default
neutron-test:
init: runtime/default
neutron-test: runtime/default
neutron-test-ks-user: runtime/default
manifests:
certificates: true
...