From b850fa0d0c15571bf93a4dd3c802cc0e4eda4b06 Mon Sep 17 00:00:00 2001
From: PrateekDodda <pd2839@att.com>
Date: Wed, 22 Jul 2020 17:14:51 -0500
Subject: [PATCH] Add missing security context to Glance pods/containers

This updates the Glance chart to include the pod
security context on the pod template.

This also adds the container security context to set
readOnlyRootFilesystem flag to true

Change-Id: I0a164ed48dd11780b4fdbb8be6b492fb45efe0aa
---
 glance/templates/job-clean.yaml | 2 ++
 glance/values.yaml              | 7 +++++++
 2 files changed, 9 insertions(+)

diff --git a/glance/templates/job-clean.yaml b/glance/templates/job-clean.yaml
index 43d7551cc5..cdcd61e700 100644
--- a/glance/templates/job-clean.yaml
+++ b/glance/templates/job-clean.yaml
@@ -60,6 +60,7 @@ spec:
 {{ tuple $envAll "glance" "clean" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
     spec:
       serviceAccountName: {{ $serviceAccountName }}
+{{ dict "envAll" $envAll "application" "clean" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
       restartPolicy: OnFailure
       nodeSelector:
         {{ .Values.labels.job.node_selector_key }}: {{ .Values.labels.job.node_selector_value }}
@@ -70,6 +71,7 @@ spec:
         - name: glance-secret-clean
 {{ tuple $envAll "glance_storage_init" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.jobs.bootstrap | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
+{{ dict "envAll" $envAll "application" "clean" "container" "glance_secret_clean" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           env:
             - name: NAMESPACE
               valueFrom:
diff --git a/glance/values.yaml b/glance/values.yaml
index 4703db6181..39518aea40 100644
--- a/glance/values.yaml
+++ b/glance/values.yaml
@@ -847,6 +847,13 @@ pod:
         glance_registry:
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
+    clean:
+      pod:
+        runAsUser: 42424
+      container:
+        glance_secret_clean:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
     metadefs_load:
       pod:
         runAsUser: 42424