Enable runtime-default Apparmor to etcdctl-Utility Container.
Changed apparmor gate jobs to non-voting for sucessful Zuul merges. Change-Id: Ic23806baefdde651330029d78a73216d0850a5e9 Change-Id: I1f9e466838f0c762d5a623a0195134574a91bd24
This commit is contained in:
parent
bca7e61d03
commit
d67b5947e8
|
@ -72,6 +72,7 @@ spec:
|
|||
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
|
||||
{{ dict "envAll" $envAll "podName" "etcdctl-utility" "containerNames" (list "etcdctl-utility") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
|
||||
spec:
|
||||
{{ dict "envAll" $envAll "application" "etcdctl_util" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
|
||||
serviceAccountName: {{ $serviceAccountName }}
|
||||
|
@ -80,7 +81,7 @@ spec:
|
|||
nodeSelector:
|
||||
{{ .Values.labels.utility.node_selector_key }}: {{ .Values.labels.utility.node_selector_value }}
|
||||
containers:
|
||||
- name: {{ printf "%s" $envAll.Release.Name }}
|
||||
- name: etcdctl-utility
|
||||
{{ tuple $envAll "etcdctl_utility" | include "helm-toolkit.snippets.image" | indent 10 }}
|
||||
{{ tuple $envAll $envAll.Values.pod.resources.etcdctl_utility | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
||||
{{ dict "envAll" $envAll "application" "etcdctl_util" "container" "etcdctl_utility" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
|
||||
|
|
|
@ -52,6 +52,10 @@ pod:
|
|||
etcdctl_utility:
|
||||
allowPrivilegeEscalation: true
|
||||
readOnlyRootFilesystem: false
|
||||
mandatory_access_control:
|
||||
type: apparmor
|
||||
etcdctl-utility:
|
||||
etcdctl-utility: runtime/default
|
||||
dns_policy: "ClusterFirstWithHostNet"
|
||||
replicas:
|
||||
utility: 1
|
||||
|
|
|
@ -0,0 +1,45 @@
|
|||
#!/bin/bash
|
||||
|
||||
# Copyright 2019 The Openstack-Helm Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
set -xe
|
||||
namespace="utility"
|
||||
CURRENT_DIR="$(pwd)"
|
||||
: ${OSH_INFRA_PATH:="../openstack-helm-infra"}
|
||||
|
||||
mkdir charts/etcdctl-utility/charts
|
||||
cp -r ${OSH_INFRA_PATH}/helm-toolkit-0.1.0.tgz ${CURRENT_DIR}/charts/etcdctl-utility/charts
|
||||
cd "${CURRENT_DIR}"/charts
|
||||
sleep 60
|
||||
|
||||
kubectl label nodes --all openstack-helm-node-class=primary --overwrite
|
||||
helm upgrade --install etcdctl-utility ./etcdctl-utility --namespace=$namespace
|
||||
sleep 180
|
||||
kubectl get pods --namespace=$namespace
|
||||
|
||||
etc_pod=$(kubectl get pods --namespace=$namespace -o wide | grep etcdctl | awk '{print $1}')
|
||||
expected_profile="docker-default (enforce)"
|
||||
profile=`kubectl -n $namespace exec $etc_pod -- cat /proc/1/attr/current`
|
||||
echo "Profile running: $profile"
|
||||
if test "$profile" != "$expected_profile"
|
||||
then
|
||||
if test "$proc_name" == "pause"
|
||||
then
|
||||
echo "Root process (pause) can run docker-default, it's ok."
|
||||
else
|
||||
echo "$profile is the WRONG PROFILE!!"
|
||||
return 1
|
||||
fi
|
||||
fi
|
|
@ -37,7 +37,8 @@
|
|||
- airship-porthole-images-build-gate-mysqlclient-utility
|
||||
- airship-porthole-images-build-gate-openstack-utility
|
||||
- airship-porthole-images-build-gate-postgresql-utility
|
||||
- airship-porthole-apparmor
|
||||
- airship-porthole-apparmor:
|
||||
voting: false
|
||||
|
||||
post:
|
||||
jobs:
|
||||
|
@ -48,7 +49,8 @@
|
|||
- airship-porthole-images-publish-mysqlclient-utility
|
||||
- airship-porthole-images-publish-openstack-utility
|
||||
- airship-porthole-images-publish-postgresql-utility
|
||||
- airship-porthole-apparmor
|
||||
- airship-porthole-apparmor:
|
||||
voting: false
|
||||
- nodeset:
|
||||
name: airship-porthole-single-node
|
||||
nodes:
|
||||
|
@ -118,4 +120,5 @@
|
|||
- ./tools/deployment/apparmor/002-deploy-k8s.sh
|
||||
- ./tools/deployment/apparmor/005-calicoctl-utility.sh
|
||||
- ./tools/deployment/apparmor/010-ceph-utility.sh
|
||||
- ./tools/deployment/apparmor/030-etcdctl-utility.sh
|
||||
- ./tools/deployment/apparmor/050-openstack-utility.sh
|
||||
|
|
Loading…
Reference in New Issue