openstack/openstack-helm-infra
Code Issues Proposed changes

prometheus-alertmanager: Fix security context

Browse Source 
This PS fixes the pod application name and also adds security context
to initcontainer

Change-Id: Ia7cd5057247b0a07f88406259d41601659688f1a
This commit is contained in:
RAHUL KHIYANI 2019-04-22 11:31:39 -05:00
parent 0ae22f4c1c
commit 95bb125207
2 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
prometheus-alertmanager/templates/statefulset.yaml
View File

@ -47,7 +47,7 @@ spec:
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "alertmanager" "containerNames" (list "alertmanager") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "alertmanager" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
{{ dict "envAll" $envAll "application" "server" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}
affinity:
{{ tuple $envAll "alertmanager" "server" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
@ -59,8 +59,7 @@ spec:
- name: alertmanager-perms
{{ tuple $envAll "alertmanager" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.alertmanager | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
securityContext:
runAsUser: 0
{{ dict "envAll" $envAll "application" "server" "container" "alertmanager_perms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
command:
- chown
- -R
@ -75,7 +74,7 @@ spec:
- name: alertmanager
{{ tuple $envAll "alertmanager" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.alertmanager | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "alertmanager" "container" "alertmanager" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
{{ dict "envAll" $envAll "application" "server" "container" "alertmanager" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
command:
- /tmp/alertmanager.sh
- start

5
prometheus-alertmanager/values.yaml
View File

@ -43,10 +43,13 @@ pod:
alertmanager:
alertmanager: localhost/docker-default
security_context:
alertmanager:
server:
pod:
runAsUser: 65534
container:
alertmanager_perms:
runAsUser: 0
readOnlyRootFilesystem: true
alertmanager:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true