openstack/openstack-helm
Code Issues Proposed changes

Merge "Add missing security context to Glance pods/containers"

Browse Source
This commit is contained in:
Zuul 2020-07-24 20:40:41 +00:00 committed by Gerrit Code Review
commit d277386769
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
glance/templates/job-clean.yaml
View File

@ -60,6 +60,7 @@ spec:
{{ tuple $envAll "glance" "clean" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }} {{ tuple $envAll "glance" "clean" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
spec: spec:
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
{{ dict "envAll" $envAll "application" "clean" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
restartPolicy: OnFailure restartPolicy: OnFailure
nodeSelector: nodeSelector:
{{ .Values.labels.job.node_selector_key }}: {{ .Values.labels.job.node_selector_value }} {{ .Values.labels.job.node_selector_key }}: {{ .Values.labels.job.node_selector_value }}
@ -70,6 +71,7 @@ spec:
- name: glance-secret-clean - name: glance-secret-clean
{{ tuple $envAll "glance_storage_init" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll "glance_storage_init" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.jobs.bootstrap | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.jobs.bootstrap | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "clean" "container" "glance_secret_clean" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env: env:
- name: NAMESPACE - name: NAMESPACE
valueFrom: valueFrom:

7
glance/values.yaml
View File

@ -847,6 +847,13 @@ pod:
glance_registry: glance_registry:
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
clean:
pod:
runAsUser: 42424
container:
glance_secret_clean:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
metadefs_load: metadefs_load:
pod: pod:
runAsUser: 42424 runAsUser: 42424