openstack/openstack-helm
Code Issues Proposed changes

Add Apparmor for Missing containers for glance and neutron pods

Browse Source 
1)Fixed nginx container in glance.
2)Fixed rpc server in neutron.
3)Enabled Certificates for creating pods.

Change-Id: Ida510ee22808b818e256f93b11d2e1ed36f63a19
Signed-off-by: diwakar thyagaraj <diwakar.chitoor.thyagaraj@att.com>
This commit is contained in:
diwakar thyagaraj 2020-08-27 15:29:05 +00:00
parent 71bc6d15c7
commit 9c39f2e328
5 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
glance/templates/deployment-api.yaml
View File

@ -43,7 +43,7 @@ spec:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "glance-api" "containerNames" ( list "glance-perms" "glance-api" "init" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{ dict "envAll" $envAll "podName" "glance-api" "containerNames" ( list "glance-perms" "glance-api" "init" "nginx" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec: spec:
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
{{ dict "envAll" $envAll "application" "glance" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} {{ dict "envAll" $envAll "application" "glance" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}

2
glance/templates/deployment-registry.yaml
View File

@ -43,7 +43,7 @@ spec:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "glance-registry" "containerNames" ( list "glance-registry" "init" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{ dict "envAll" $envAll "podName" "glance-registry" "containerNames" ( list "glance-registry" "init" "nginx" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec: spec:
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
{{ dict "envAll" $envAll "application" "glance" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} {{ dict "envAll" $envAll "application" "glance" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}

3
glance/values_overrides/apparmor.yaml
View File

@ -6,9 +6,11 @@ pod:
glance-api: runtime/default glance-api: runtime/default
glance-perms: runtime/default glance-perms: runtime/default
init: runtime/default init: runtime/default
nginx: runtime/default
glance-registry: glance-registry:
glance-registry: runtime/default glance-registry: runtime/default
init: runtime/default init: runtime/default
nginx: runtime/default
glance-metadefs-load: glance-metadefs-load:
init: runtime/default init: runtime/default
glance-metadefs-load: runtime/default glance-metadefs-load: runtime/default
@ -21,4 +23,5 @@ pod:
glance-test-ks-user: runtime/default glance-test-ks-user: runtime/default
manifests: manifests:
deployment_registry: true deployment_registry: true
certificates: true
... ...

2
neutron/templates/deployment-server.yaml
View File

@ -55,7 +55,7 @@ spec:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "neutron-server" "containerNames" (list "neutron-server" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{ dict "envAll" $envAll "podName" "neutron-server" "containerNames" (list "neutron-server" "init" "neutron-rpc-server") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec: spec:
{{ dict "envAll" $envAll "application" "neutron_server" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} {{ dict "envAll" $envAll "application" "neutron_server" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}

3
neutron/values_overrides/apparmor.yaml
View File

@ -31,8 +31,11 @@ pod:
neutron-server: neutron-server:
neutron-server: runtime/default neutron-server: runtime/default
init: runtime/default init: runtime/default
neutron-rpc-server: runtime/default
neutron-test: neutron-test:
init: runtime/default init: runtime/default
neutron-test: runtime/default neutron-test: runtime/default
neutron-test-ks-user: runtime/default neutron-test-ks-user: runtime/default
manifests:
certificates: true
... ...