Merge "ceph-osd: Fix security context"

ceph-osd/templates/daemonset-osd.yaml

@@ -43,6 +43,7 @@ spec:
 {{ dict "envAll" $envAll "podName" "ceph-osd-default" "containerNames" (list "ceph-osd-default") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
     spec:
+{{ dict "envAll" $envAll "application" "osd" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
       serviceAccountName: {{ $serviceAccountName }}
       nodeSelector:
         {{ .Values.labels.osd.node_selector_key }}: {{ .Values.labels.osd.node_selector_value }}
@@ -53,6 +54,7 @@ spec:
 {{ tuple $envAll "osd" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
         - name: ceph-init-dirs
 {{ tuple $envAll "ceph_osd" | include "helm-toolkit.snippets.image" | indent 10 }}
+{{ dict "envAll" $envAll "application" "osd" "container" "ceph_init_dirs" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           command:
             - /tmp/init-dirs.sh
           env:
@@ -102,8 +104,7 @@ spec:
               readOnly: false
         - name: ceph-log-ownership
 {{ tuple $envAll "ceph_osd" | include "helm-toolkit.snippets.image" | indent 10 }}
-          securityContext:
-            runAsUser: 0
+{{ dict "envAll" $envAll "application" "osd" "container" "ceph_log_ownership" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           env:
           # NOTE(portdirect): These environment variables will be populated
           # dynamicly at the point of render and added to all containers in the
@@ -138,8 +139,7 @@ spec:
         - name: osd-init
 {{ tuple $envAll "ceph_osd" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.osd | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
-          securityContext:
-            privileged: true
+{{ dict "envAll" $envAll "application" "osd" "container" "osd_init" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           env:
           # NOTE(portdirect): These environment variables will be populated
           # dynamicly at the point of render and added to all containers in the
@@ -214,8 +214,7 @@ spec:
         - name: osd-pod
 {{ tuple $envAll "ceph_osd" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.osd | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
-          securityContext:
-            privileged: true
+{{ dict "envAll" $envAll "application" "osd" "container" "osd_pod" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           env:
           # NOTE(portdirect): These environment variables will be populated
           # dynamicly at the point of render.

ceph-osd/templates/job-bootstrap.yaml

@@ -32,6 +32,7 @@ spec:
       labels:
 {{ tuple $envAll "ceph" "bootstrap" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
     spec:
+{{ dict "envAll" $envAll "application" "bootstrap" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
       serviceAccountName: {{ $serviceAccountName }}
       restartPolicy: OnFailure
       nodeSelector:
@@ -42,6 +43,7 @@ spec:
         - name: ceph-osd-bootstrap
 {{ tuple $envAll "ceph_bootstrap" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.jobs.bootstrap | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
+{{ dict "envAll" $envAll "application" "bootstrap" "container" "ceph_osd_bootstrap" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           command:
             - /tmp/bootstrap.sh
           volumeMounts:

ceph-osd/templates/pod-helm-tests.yaml

@@ -29,6 +29,7 @@ metadata:
   annotations:
     "helm.sh/hook": test-success
 spec:
+{{ dict "envAll" $envAll "application" "test" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 2 }}
   restartPolicy: Never
   serviceAccountName: {{ $serviceAccountName }}
   initContainers:
@@ -37,6 +38,7 @@ spec:
     - name: ceph-cluster-helm-test
 {{ tuple $envAll "ceph_config_helper" | include "helm-toolkit.snippets.image" | indent 6 }}
 {{ tuple $envAll $envAll.Values.pod.resources.jobs.tests | include "helm-toolkit.snippets.kubernetes_resources" | indent 6 }}
+{{ dict "envAll" $envAll "application" "test" "container" "ceph_cluster_helm_test" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 6 }}
       env:
         - name: CEPH_DEPLOYMENT_NAMESPACE
           value: {{ .Release.Namespace }}

ceph-osd/values.yaml

@@ -40,6 +40,33 @@ labels:
     node_selector_value: enabled
 
 pod:
+  security_context:
+    osd:
+      pod:
+        runAsUser: 0
+      container:
+        ceph_init_dirs:
+          readOnlyRootFilesystem: true
+        ceph_log_ownership:
+          readOnlyRootFilesystem: true
+        osd_init:
+          privileged: true
+          readOnlyRootFilesystem: true
+        osd_pod:
+          privileged: true
+          readOnlyRootFilesystem: false
+    bootstrap:
+      pod:
+        runAsUser: 0
+      container:
+        ceph_osd_bootstrap:
+          readOnlyRootFilesystem: true
+    test:
+      pod:
+        runAsUser: 0
+      container:
+        ceph_cluster_helm_test:
+          readOnlyRootFilesystem: true
   dns_policy: "ClusterFirstWithHostNet"
   affinity:
     anti: