openstack/openstack-helm-addons
Code Issues Proposed changes

Add missing security context to Ranger pods/containers

Browse Source 
This updates the Ranger chart to include the pod
security context on the pod template.

This also adds the container security context to set
readOnlyRootFilesystem flag to true.

Depends-On: https://review.opendev.org/740119/

Change-Id: Ic06caec81015ac04fb162d8c2482da6b2329e204
This commit is contained in:
DODDA, PRATEEK REDDY 2020-07-08 14:44:46 -05:00 committed by diwakar thyagaraj
parent f2d430c985
commit cbafbe21e7
9 changed files with 96 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ranger/templates/deployment-audit-service.yaml
View File

@ -66,7 +66,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-audit-service" "containerNames" (list "init" "ranger-audit-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{ dict "envAll" $envAll "podName" "ranger-audit-service" "containerNames" (list "init" "ranger-audit-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec: spec:
{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} {{ dict "envAll" $envAll "application" "audit" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
affinity: affinity:
{{ tuple $envAll "ranger" "audit" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} {{ tuple $envAll "ranger" "audit" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -80,7 +80,7 @@ spec:
image: {{ .Values.images.tags.ranger }} image: {{ .Values.images.tags.ranger }}
imagePullPolicy: {{ .Values.images.pull_policy }} imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "ranger" "container" "audit" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} {{ dict "envAll" $envAll "application" "audit" "container" "ranger_audit_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env: env:
- name: SERVICE_TYPE - name: SERVICE_TYPE
value: "audit" value: "audit"
@ -99,6 +99,8 @@ spec:
{{ dict "envAll" $envAll "component" "audit" "container" "ranger-audit-service" "type" "readiness" "probeTemplate" (include "RangerAuditServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "audit" "container" "ranger-audit-service" "type" "readiness" "probeTemplate" (include "RangerAuditServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
{{ dict "envAll" $envAll "component" "audit" "container" "ranger-audit-service" "type" "liveness" "probeTemplate" (include "RangerAuditServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "audit" "container" "ranger-audit-service" "type" "liveness" "probeTemplate" (include "RangerAuditServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
volumeMounts: volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: pod-etc-ranger - name: pod-etc-ranger
mountPath: /etc/ranger mountPath: /etc/ranger
- name: ranger-bin - name: ranger-bin
@ -115,6 +117,8 @@ spec:
readOnly: true readOnly: true
{{ if $mounts_audit.volumeMounts }}{{ toYaml $mounts_audit.volumeMounts | indent 12 }}{{ end }} {{ if $mounts_audit.volumeMounts }}{{ toYaml $mounts_audit.volumeMounts | indent 12 }}{{ end }}
volumes: volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-ranger - name: pod-etc-ranger
emptyDir: {} emptyDir: {}
- name: ranger-bin - name: ranger-bin

8
ranger/templates/deployment-cms-service.yaml
View File

@ -66,7 +66,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-cms-service" "containerNames" (list "init" "ranger-cms-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{ dict "envAll" $envAll "podName" "ranger-cms-service" "containerNames" (list "init" "ranger-cms-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec: spec:
{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} {{ dict "envAll" $envAll "application" "cms" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
affinity: affinity:
{{ tuple $envAll "ranger" "cms" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} {{ tuple $envAll "ranger" "cms" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -80,7 +80,7 @@ spec:
image: {{ .Values.images.tags.ranger }} image: {{ .Values.images.tags.ranger }}
imagePullPolicy: {{ .Values.images.pull_policy }} imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "ranger" "container" "cms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} {{ dict "envAll" $envAll "application" "cms" "container" "ranger_cms_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env: env:
- name: SERVICE_TYPE - name: SERVICE_TYPE
value: "cms" value: "cms"
@ -99,6 +99,8 @@ spec:
{{ dict "envAll" $envAll "component" "cms" "container" "ranger-cms-service" "type" "readiness" "probeTemplate" (include "RangerCmsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "cms" "container" "ranger-cms-service" "type" "readiness" "probeTemplate" (include "RangerCmsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
{{ dict "envAll" $envAll "component" "cms" "container" "ranger-cms-service" "type" "liveness" "probeTemplate" (include "RangerCmsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "cms" "container" "ranger-cms-service" "type" "liveness" "probeTemplate" (include "RangerCmsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
volumeMounts: volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: pod-etc-ranger - name: pod-etc-ranger
mountPath: /etc/ranger mountPath: /etc/ranger
- name: ranger-bin - name: ranger-bin
@ -115,6 +117,8 @@ spec:
readOnly: true readOnly: true
{{ if $mounts_cms.volumeMounts }}{{ toYaml $mounts_cms.volumeMounts | indent 12 }}{{ end }} {{ if $mounts_cms.volumeMounts }}{{ toYaml $mounts_cms.volumeMounts | indent 12 }}{{ end }}
volumes: volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-ranger - name: pod-etc-ranger
emptyDir: {} emptyDir: {}
- name: ranger-bin - name: ranger-bin

8
ranger/templates/deployment-fms-service.yaml
View File

@ -66,7 +66,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-fms-service" "containerNames" (list "init" "ranger-fms-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{ dict "envAll" $envAll "podName" "ranger-fms-service" "containerNames" (list "init" "ranger-fms-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec: spec:
{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} {{ dict "envAll" $envAll "application" "fms" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
affinity: affinity:
{{ tuple $envAll "ranger" "fms" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} {{ tuple $envAll "ranger" "fms" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -80,7 +80,7 @@ spec:
image: {{ .Values.images.tags.ranger }} image: {{ .Values.images.tags.ranger }}
imagePullPolicy: {{ .Values.images.pull_policy }} imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "ranger" "container" "fms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} {{ dict "envAll" $envAll "application" "fms" "container" "ranger_fms_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env: env:
- name: SERVICE_TYPE - name: SERVICE_TYPE
value: "fms" value: "fms"
@ -99,6 +99,8 @@ spec:
{{ dict "envAll" $envAll "component" "fms" "container" "ranger-fms-service" "type" "readiness" "probeTemplate" (include "RangerFmsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "fms" "container" "ranger-fms-service" "type" "readiness" "probeTemplate" (include "RangerFmsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
{{ dict "envAll" $envAll "component" "fms" "container" "ranger-fms-service" "type" "liveness" "probeTemplate" (include "RangerFmsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "fms" "container" "ranger-fms-service" "type" "liveness" "probeTemplate" (include "RangerFmsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
volumeMounts: volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: pod-etc-ranger - name: pod-etc-ranger
mountPath: /etc/ranger mountPath: /etc/ranger
- name: ranger-bin - name: ranger-bin
@ -115,6 +117,8 @@ spec:
readOnly: true readOnly: true
{{ if $mounts_fms.volumeMounts }}{{ toYaml $mounts_fms.volumeMounts | indent 12 }}{{ end }} {{ if $mounts_fms.volumeMounts }}{{ toYaml $mounts_fms.volumeMounts | indent 12 }}{{ end }}
volumes: volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-ranger - name: pod-etc-ranger
emptyDir: {} emptyDir: {}
- name: ranger-bin - name: ranger-bin

8
ranger/templates/deployment-ims-service.yaml
View File

@ -66,7 +66,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-ims-service" "containerNames" (list "init" "ranger-ims-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{ dict "envAll" $envAll "podName" "ranger-ims-service" "containerNames" (list "init" "ranger-ims-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec: spec:
{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} {{ dict "envAll" $envAll "application" "ims" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
affinity: affinity:
{{ tuple $envAll "ranger" "ims" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} {{ tuple $envAll "ranger" "ims" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -80,7 +80,7 @@ spec:
image: {{ .Values.images.tags.ranger }} image: {{ .Values.images.tags.ranger }}
imagePullPolicy: {{ .Values.images.pull_policy }} imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "ranger" "container" "ims" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} {{ dict "envAll" $envAll "application" "ims" "container" "ranger_ims_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env: env:
- name: SERVICE_TYPE - name: SERVICE_TYPE
value: "ims" value: "ims"
@ -99,6 +99,8 @@ spec:
{{ dict "envAll" $envAll "component" "ims" "container" "ranger-ims-service" "type" "readiness" "probeTemplate" (include "RangerImsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "ims" "container" "ranger-ims-service" "type" "readiness" "probeTemplate" (include "RangerImsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
{{ dict "envAll" $envAll "component" "ims" "container" "ranger-ims-service" "type" "liveness" "probeTemplate" (include "RangerImsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "ims" "container" "ranger-ims-service" "type" "liveness" "probeTemplate" (include "RangerImsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
volumeMounts: volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: pod-etc-ranger - name: pod-etc-ranger
mountPath: /etc/ranger mountPath: /etc/ranger
- name: ranger-bin - name: ranger-bin
@ -115,6 +117,8 @@ spec:
readOnly: true readOnly: true
{{ if $mounts_ims.volumeMounts }}{{ toYaml $mounts_ims.volumeMounts | indent 12 }}{{ end }} {{ if $mounts_ims.volumeMounts }}{{ toYaml $mounts_ims.volumeMounts | indent 12 }}{{ end }}
volumes: volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-ranger - name: pod-etc-ranger
emptyDir: {} emptyDir: {}
- name: ranger-bin - name: ranger-bin

8
ranger/templates/deployment-rds-service.yaml
View File

@ -65,7 +65,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-rds-service" "containerNames" (list "init" "ranger-rds-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{ dict "envAll" $envAll "podName" "ranger-rds-service" "containerNames" (list "init" "ranger-rds-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec: spec:
{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} {{ dict "envAll" $envAll "application" "rds" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
affinity: affinity:
{{ tuple $envAll "ranger" "rds" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} {{ tuple $envAll "ranger" "rds" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -79,7 +79,7 @@ spec:
image: {{ .Values.images.tags.ranger }} image: {{ .Values.images.tags.ranger }}
imagePullPolicy: {{ .Values.images.pull_policy }} imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "ranger" "container" "rds" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} {{ dict "envAll" $envAll "application" "rds" "container" "ranger_rds_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env: env:
{{- if .Values.manifests.secret_ssh_key }} {{- if .Values.manifests.secret_ssh_key }}
- name: USER - name: USER
@ -146,6 +146,8 @@ spec:
{{ dict "envAll" $envAll "component" "rds" "container" "ranger-rds-service" "type" "readiness" "probeTemplate" (include "RangerRdsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "rds" "container" "ranger-rds-service" "type" "readiness" "probeTemplate" (include "RangerRdsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
{{ dict "envAll" $envAll "component" "rds" "container" "ranger-rds-service" "type" "liveness" "probeTemplate" (include "RangerRdsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "rds" "container" "ranger-rds-service" "type" "liveness" "probeTemplate" (include "RangerRdsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
volumeMounts: volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: pod-etc-ranger - name: pod-etc-ranger
mountPath: /etc/ranger mountPath: /etc/ranger
- name: ranger-bin - name: ranger-bin
@ -162,6 +164,8 @@ spec:
readOnly: true readOnly: true
{{ if $mounts_rds.volumeMounts }}{{ toYaml $mounts_rds.volumeMounts | indent 12 }}{{ end }} {{ if $mounts_rds.volumeMounts }}{{ toYaml $mounts_rds.volumeMounts | indent 12 }}{{ end }}
volumes: volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-ranger - name: pod-etc-ranger
emptyDir: {} emptyDir: {}
- name: ranger-bin - name: ranger-bin

8
ranger/templates/deployment-rms-service.yaml
View File

@ -66,7 +66,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-rms-service" "containerNames" (list "init" "ranger-rms-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{ dict "envAll" $envAll "podName" "ranger-rms-service" "containerNames" (list "init" "ranger-rms-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec: spec:
{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} {{ dict "envAll" $envAll "application" "rms" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
affinity: affinity:
{{ tuple $envAll "ranger" "rms" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} {{ tuple $envAll "ranger" "rms" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -80,7 +80,7 @@ spec:
image: {{ .Values.images.tags.ranger }} image: {{ .Values.images.tags.ranger }}
imagePullPolicy: {{ .Values.images.pull_policy }} imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "ranger" "container" "rms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} {{ dict "envAll" $envAll "application" "rms" "container" "ranger_rms_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env: env:
- name: SERVICE_TYPE - name: SERVICE_TYPE
value: "rms" value: "rms"
@ -99,6 +99,8 @@ spec:
{{ dict "envAll" $envAll "component" "rms" "container" "ranger-rms-service" "type" "readiness" "probeTemplate" (include "RangerRmsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "rms" "container" "ranger-rms-service" "type" "readiness" "probeTemplate" (include "RangerRmsServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
{{ dict "envAll" $envAll "component" "rms" "container" "ranger-rms-service" "type" "liveness" "probeTemplate" (include "RangerRmsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "rms" "container" "ranger-rms-service" "type" "liveness" "probeTemplate" (include "RangerRmsServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
volumeMounts: volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: pod-etc-ranger - name: pod-etc-ranger
mountPath: /etc/ranger mountPath: /etc/ranger
- name: ranger-bin - name: ranger-bin
@ -115,6 +117,8 @@ spec:
readOnly: true readOnly: true
{{ if $mounts_rms.volumeMounts }}{{ toYaml $mounts_rms.volumeMounts | indent 12 }}{{ end }} {{ if $mounts_rms.volumeMounts }}{{ toYaml $mounts_rms.volumeMounts | indent 12 }}{{ end }}
volumes: volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-ranger - name: pod-etc-ranger
emptyDir: {} emptyDir: {}
- name: ranger-bin - name: ranger-bin

8
ranger/templates/deployment-uuid-service.yaml
View File

@ -66,7 +66,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "ranger-uuid-service" "containerNames" (list "init" "ranger-uuid-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{ dict "envAll" $envAll "podName" "ranger-uuid-service" "containerNames" (list "init" "ranger-uuid-service") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec: spec:
{{ dict "envAll" $envAll "application" "ranger" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} {{ dict "envAll" $envAll "application" "uuid" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
affinity: affinity:
{{ tuple $envAll "ranger" "uuid" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} {{ tuple $envAll "ranger" "uuid" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -80,7 +80,7 @@ spec:
image: {{ .Values.images.tags.ranger }} image: {{ .Values.images.tags.ranger }}
imagePullPolicy: {{ .Values.images.pull_policy }} imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.ranger | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "ranger" "container" "uuid" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} {{ dict "envAll" $envAll "application" "uuid" "container" "ranger_uuid_service" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env: env:
- name: SERVICE_TYPE - name: SERVICE_TYPE
value: "uuid" value: "uuid"
@ -99,6 +99,8 @@ spec:
{{ dict "envAll" $envAll "component" "uuid" "container" "ranger-uuid-service" "type" "readiness" "probeTemplate" (include "RangerUuidServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "uuid" "container" "ranger-uuid-service" "type" "readiness" "probeTemplate" (include "RangerUuidServiceReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
{{ dict "envAll" $envAll "component" "uuid" "container" "ranger-uuid-service" "type" "liveness" "probeTemplate" (include "RangerUuidServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }} {{ dict "envAll" $envAll "component" "uuid" "container" "ranger-uuid-service" "type" "liveness" "probeTemplate" (include "RangerUuidServiceLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
volumeMounts: volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: pod-etc-ranger - name: pod-etc-ranger
mountPath: /etc/ranger mountPath: /etc/ranger
- name: ranger-bin - name: ranger-bin
@ -115,6 +117,8 @@ spec:
readOnly: true readOnly: true
{{ if $mounts_uuid.volumeMounts }}{{ toYaml $mounts_uuid.volumeMounts | indent 12 }}{{ end }} {{ if $mounts_uuid.volumeMounts }}{{ toYaml $mounts_uuid.volumeMounts | indent 12 }}{{ end }}
volumes: volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-ranger - name: pod-etc-ranger
emptyDir: {} emptyDir: {}
- name: ranger-bin - name: ranger-bin

2
ranger/templates/pod-test.yaml
View File

@ -32,6 +32,7 @@ metadata:
{{ tuple $envAll "ranger" "test" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }} {{ tuple $envAll "ranger" "test" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
spec: spec:
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
{{ dict "envAll" $envAll "application" "test" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 2 }}
nodeSelector: nodeSelector:
{{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }} {{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }}
restartPolicy: Never restartPolicy: Never
@ -40,6 +41,7 @@ spec:
containers: containers:
- name: {{.Release.Name}}-test - name: {{.Release.Name}}-test
image: {{ .Values.images.tags.scripted_test }} image: {{ .Values.images.tags.scripted_test }}
{{ dict "envAll" $envAll "application" "test" "container" "ranger_test" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 6 }}
env: env:
- name: cms - name: cms
value: {{ tuple "cms" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" | trimSuffix .Values.endpoints.cms.path.default }} value: {{ tuple "cms" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" | trimSuffix .Values.endpoints.cms.path.default }}

55
ranger/values.yaml
View File

@ -145,12 +145,61 @@ dependencies:
pod: pod:
security_context: security_context:
ranger: audit:
pod: pod:
runAsUser: 1000 runAsUser: 1000
container: container:
ranger_services: ranger_audit_service:
readOnlyRootFilesystem: false readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
cms:
pod:
runAsUser: 1000
container:
ranger_cms_service:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
fms:
pod:
runAsUser: 1000
container:
ranger_fms_service:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
ims:
pod:
runAsUser: 1000
container:
ranger_ims_service:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
rds:
pod:
runAsUser: 1000
container:
ranger_rds_service:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
rms:
pod:
runAsUser: 1000
container:
ranger_rms_service:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
uuid:
pod:
runAsUser: 1000
container:
ranger_uuid_service:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
test:
pod:
runAsUser: 1000
container:
ranger_test:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
affinity: affinity:
anti: anti: