From a881f3def47dffc2f4755b0a79574be8b98f9221 Mon Sep 17 00:00:00 2001 From: RAHUL KHIYANI Date: Tue, 23 Apr 2019 23:00:41 -0500 Subject: [PATCH] ceph-osd: Fix security context This PS fixes the use of the security context macros for the ceph-osd chart Change-Id: I75cb057d08831fb39e9846fbab53e3ee6e113ada --- ceph-osd/templates/daemonset-osd.yaml | 11 +++++------ ceph-osd/templates/job-bootstrap.yaml | 2 ++ ceph-osd/templates/pod-helm-tests.yaml | 2 ++ ceph-osd/values.yaml | 27 ++++++++++++++++++++++++++ 4 files changed, 36 insertions(+), 6 deletions(-) diff --git a/ceph-osd/templates/daemonset-osd.yaml b/ceph-osd/templates/daemonset-osd.yaml index 33bbfe85d..fc496ccf8 100644 --- a/ceph-osd/templates/daemonset-osd.yaml +++ b/ceph-osd/templates/daemonset-osd.yaml @@ -43,6 +43,7 @@ spec: {{ dict "envAll" $envAll "podName" "ceph-osd-default" "containerNames" (list "ceph-osd-default") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} spec: +{{ dict "envAll" $envAll "application" "osd" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} nodeSelector: {{ .Values.labels.osd.node_selector_key }}: {{ .Values.labels.osd.node_selector_value }} @@ -53,6 +54,7 @@ spec: {{ tuple $envAll "osd" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }} - name: ceph-init-dirs {{ tuple $envAll "ceph_osd" | include "helm-toolkit.snippets.image" | indent 10 }} +{{ dict "envAll" $envAll "application" "osd" "container" "ceph_init_dirs" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} command: - /tmp/init-dirs.sh env: @@ -102,8 +104,7 @@ spec: readOnly: false - name: ceph-log-ownership {{ tuple $envAll "ceph_osd" | include "helm-toolkit.snippets.image" | indent 10 }} - securityContext: - runAsUser: 0 +{{ dict "envAll" $envAll "application" "osd" "container" "ceph_log_ownership" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: # NOTE(portdirect): These environment variables will be populated # dynamicly at the point of render and added to all containers in the @@ -138,8 +139,7 @@ spec: - name: osd-init {{ tuple $envAll "ceph_osd" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.osd | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} - securityContext: - privileged: true +{{ dict "envAll" $envAll "application" "osd" "container" "osd_init" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: # NOTE(portdirect): These environment variables will be populated # dynamicly at the point of render and added to all containers in the @@ -214,8 +214,7 @@ spec: - name: osd-pod {{ tuple $envAll "ceph_osd" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.osd | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} - securityContext: - privileged: true +{{ dict "envAll" $envAll "application" "osd" "container" "osd_pod" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: # NOTE(portdirect): These environment variables will be populated # dynamicly at the point of render. diff --git a/ceph-osd/templates/job-bootstrap.yaml b/ceph-osd/templates/job-bootstrap.yaml index 67b7b6cf2..172fd64b3 100644 --- a/ceph-osd/templates/job-bootstrap.yaml +++ b/ceph-osd/templates/job-bootstrap.yaml @@ -32,6 +32,7 @@ spec: labels: {{ tuple $envAll "ceph" "bootstrap" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }} spec: +{{ dict "envAll" $envAll "application" "bootstrap" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} restartPolicy: OnFailure nodeSelector: @@ -42,6 +43,7 @@ spec: - name: ceph-osd-bootstrap {{ tuple $envAll "ceph_bootstrap" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.jobs.bootstrap | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} +{{ dict "envAll" $envAll "application" "bootstrap" "container" "ceph_osd_bootstrap" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} command: - /tmp/bootstrap.sh volumeMounts: diff --git a/ceph-osd/templates/pod-helm-tests.yaml b/ceph-osd/templates/pod-helm-tests.yaml index 9367d231a..3a41403e1 100644 --- a/ceph-osd/templates/pod-helm-tests.yaml +++ b/ceph-osd/templates/pod-helm-tests.yaml @@ -29,6 +29,7 @@ metadata: annotations: "helm.sh/hook": test-success spec: +{{ dict "envAll" $envAll "application" "test" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 2 }} restartPolicy: Never serviceAccountName: {{ $serviceAccountName }} initContainers: @@ -37,6 +38,7 @@ spec: - name: ceph-cluster-helm-test {{ tuple $envAll "ceph_config_helper" | include "helm-toolkit.snippets.image" | indent 6 }} {{ tuple $envAll $envAll.Values.pod.resources.jobs.tests | include "helm-toolkit.snippets.kubernetes_resources" | indent 6 }} +{{ dict "envAll" $envAll "application" "test" "container" "ceph_cluster_helm_test" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 6 }} env: - name: CEPH_DEPLOYMENT_NAMESPACE value: {{ .Release.Namespace }} diff --git a/ceph-osd/values.yaml b/ceph-osd/values.yaml index 232ce65b0..f173f171e 100644 --- a/ceph-osd/values.yaml +++ b/ceph-osd/values.yaml @@ -40,6 +40,33 @@ labels: node_selector_value: enabled pod: + security_context: + osd: + pod: + runAsUser: 0 + container: + ceph_init_dirs: + readOnlyRootFilesystem: true + ceph_log_ownership: + readOnlyRootFilesystem: true + osd_init: + privileged: true + readOnlyRootFilesystem: true + osd_pod: + privileged: true + readOnlyRootFilesystem: false + bootstrap: + pod: + runAsUser: 0 + container: + ceph_osd_bootstrap: + readOnlyRootFilesystem: true + test: + pod: + runAsUser: 0 + container: + ceph_cluster_helm_test: + readOnlyRootFilesystem: true dns_policy: "ClusterFirstWithHostNet" affinity: anti: