From 1fe823d6ab92ae49f15c55dc523f49a8e4b2102c Mon Sep 17 00:00:00 2001
From: pd2839 <pd2839@att.com>
Date: Mon, 25 Feb 2019 16:18:55 -0600
Subject: [PATCH] [WIP] Implement Security Context for Armada

Implement container and pod level security context for the following
Armada resources:

- Armada server deployment

Change-Id: Ic4caba4a75ba00c92aff2e8fc16e480463632e04
---
 charts/armada/templates/deployment-api.yaml |  4 ++--
 charts/armada/values.yaml                   | 11 ++++++++---
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/charts/armada/templates/deployment-api.yaml b/charts/armada/templates/deployment-api.yaml
index 23761edd..a36236b1 100644
--- a/charts/armada/templates/deployment-api.yaml
+++ b/charts/armada/templates/deployment-api.yaml
@@ -82,6 +82,7 @@ spec:
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
         configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
     spec:
+{{ dict "envAll" $envAll "application" "armada" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
       serviceAccountName: {{ $serviceAccountName }}
       affinity:
 {{ tuple $envAll "armada" "api" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@@ -94,6 +95,7 @@ spec:
         - name: armada-api
 {{ tuple $envAll "api" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
+{{ dict "envAll" $envAll "application" "armada" "container" "armada_api" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           {{- if .Values.pod.env.armada_api }}
           env:
             {{- range .Values.pod.env.armada_api }}
@@ -101,8 +103,6 @@ spec:
               value: {{ .value | quote }}
             {{- end }}
           {{- end }}
-          securityContext:
-            runAsUser: {{ .Values.pod.user.armada.uid }}
           ports:
             - name: armada-api
               containerPort: {{ tuple "armada" "internal" "api" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
diff --git a/charts/armada/values.yaml b/charts/armada/values.yaml
index 979f3d36..60e9a660 100644
--- a/charts/armada/values.yaml
+++ b/charts/armada/values.yaml
@@ -211,6 +211,14 @@ conf:
     history_max: 0
 
 pod:
+  security_context:
+    armada:
+      pod:
+        runAsUser: 65534
+      container:
+        armada_api: 
+          allowreadOnlyRootFilesystem: true
+          PrivilegeEscalation: false
   env:
     # NOTE(@drewwalters96): These configuration values change the Armada API's
     #    uWSGI configuration.
@@ -240,9 +248,6 @@ pod:
   mounts:
     armada_api:
       init_container: null
-  user:
-    armada:
-      uid: 1000
   affinity:
     anti:
       type: