Browse Source

Implement helm-toolkit snippet to drydock pods/containers

This updates the drydock chart to include the pod
security context on the pod template.

This also adds the container security context to set
readOnlyRootFilesystem flag to true

Change-Id: Ibeb60d0b88f3519730b5b76996ab137c5af4f4f5
changes/59/738659/6
KHIYANI, RAHUL (rk0850) 1 year ago
committed by Rahul Khiyani
parent
commit
63f7783da2
  1. 2
      charts/drydock/templates/job-drydock-db-init.yaml
  2. 2
      charts/drydock/templates/job-drydock-db-sync.yaml
  3. 2
      charts/drydock/templates/tests/test-drydock-api.yaml
  4. 2
      charts/drydock/templates/tests/test-drydock-auth.yaml
  5. 28
      charts/drydock/values.yaml

2
charts/drydock/templates/job-drydock-db-init.yaml

@ -36,6 +36,7 @@ spec:
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
spec:
{{ dict "envAll" $envAll "application" "db_init" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}
restartPolicy: OnFailure
nodeSelector:
@ -47,6 +48,7 @@ spec:
image: {{ .Values.images.tags.drydock_db_init | quote }}
imagePullPolicy: {{ .Values.images.pull_policy | quote }}
{{ tuple $envAll $envAll.Values.pod.resources.jobs.drydock_db_init | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "db_init" "container" "drydock_db_init" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env:
- name: USER_DB_NAME
valueFrom:

2
charts/drydock/templates/job-drydock-db-sync.yaml

@ -36,6 +36,7 @@ spec:
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
spec:
{{ dict "envAll" $envAll "application" "db_sync" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}
restartPolicy: OnFailure
nodeSelector:
@ -47,6 +48,7 @@ spec:
image: {{ .Values.images.tags.drydock_db_sync | quote }}
imagePullPolicy: {{ .Values.images.pull_policy | quote }}
{{ tuple $envAll $envAll.Values.pod.resources.jobs.drydock_db_sync | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "db_sync" "container" "drydock_db_sync" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env:
- name: DRYDOCK_DB_URL
valueFrom:

2
charts/drydock/templates/tests/test-drydock-api.yaml

@ -29,6 +29,7 @@ metadata:
labels:
{{ tuple $envAll "drydock" "api-test" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
spec:
{{ dict "envAll" $envAll "application" "api_test" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 2 }}
restartPolicy: Never
nodeSelector:
{{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }}
@ -40,6 +41,7 @@ spec:
image: {{ .Values.images.tags.drydock }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple . .Values.pod.resources.test | include "helm-toolkit.snippets.kubernetes_resources" | indent 6 }}
{{ dict "envAll" $envAll "application" "api_test" "container" "drydock_api_test" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 6 }}
command: ["/bin/bash", "-c", "curl -v -X GET --fail ${DRYDOCK_URL}/api/v1.0/health; exit $?"]
...
{{- end }}

2
charts/drydock/templates/tests/test-drydock-auth.yaml

@ -30,6 +30,7 @@ metadata:
labels:
{{ tuple $envAll "drydock" "auth-test" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
spec:
{{ dict "envAll" $envAll "application" "auth_test" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 2 }}
restartPolicy: Never
nodeSelector:
{{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }}
@ -41,6 +42,7 @@ spec:
image: {{ .Values.images.tags.drydock }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple . .Values.pod.resources.test | include "helm-toolkit.snippets.kubernetes_resources" | indent 6 }}
{{ dict "envAll" $envAll "application" "auth_test" "container" "drydock_auth_test" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 6 }}
command: ["/bin/bash", "-c", 'curl -v -X GET --fail ${DRYDOCK_URL}/api/v1.0/tasks; exit_code=$?; if [ "$exit_code" = "22" ]; then exit 0; fi; exit 1']
...
{{- end }}

28
charts/drydock/values.yaml

@ -79,8 +79,36 @@ pod:
runAsUser: 65534
container:
drydock_api:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
db_init:
pod:
runAsUser: 65534
container:
drydock_db_init:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
db_sync:
pod:
runAsUser: 65534
container:
drydock_db_sync:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
api_test:
pod:
runAsUser: 65534
container:
drydock_api_test:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
auth_test:
pod:
runAsUser: 65534
container:
drydock_auth_test:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
lifecycle:
upgrades:
deployments:

Loading…
Cancel
Save