diff --git a/tiller/templates/deployment-tiller.yaml b/tiller/templates/deployment-tiller.yaml index 885618bc6..fedf65115 100644 --- a/tiller/templates/deployment-tiller.yaml +++ b/tiller/templates/deployment-tiller.yaml @@ -62,6 +62,7 @@ spec: {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} spec: +{{ dict "envAll" $envAll "application" "tiller" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} initContainers: {{ tuple $envAll "tiller" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }} containers: @@ -82,6 +83,7 @@ spec: successThreshold: 1 timeoutSeconds: 1 name: tiller +{{ dict "envAll" $envAll "application" "tiller" "container" "tiller" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 8 }} ports: - containerPort: 44134 name: tiller diff --git a/tiller/values.yaml b/tiller/values.yaml index d17996fd2..b1ba1447d 100644 --- a/tiller/values.yaml +++ b/tiller/values.yaml @@ -37,6 +37,13 @@ images: - image_repo_sync pod: + security_context: + tiller: + pod: + runAsUser: 65534 + container: + tiller: + allowPrivilegeEscalation: false resources: enabled: false jobs: