openstack/openstack-helm
Code Issues Proposed changes

Security: Container user for support openstack services

Browse Source 
This PS adds user control for the service user for support openstack
services.

Change-Id: I132511bfc09d20a2f155bb9498a7fe8eeee8b6f9
This commit is contained in:
Pete Birley 2017-08-24 22:03:51 -05:00
parent 7463058b73
commit 27864cec04
15 changed files with 37 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
glance/templates/deployment-api.yaml
View File

@ -62,6 +62,8 @@ spec:
- name: ceph-keyring-placement
image: {{ .Values.images.api }}
imagePullPolicy: {{ .Values.images.pull_policy }}
securityContext:
runAsUser: {{ .Values.pod.user.glance.uid }}
command:
- /tmp/ceph-keyring.sh
volumeMounts:
@ -81,6 +83,8 @@ spec:
image: {{ .Values.images.api }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
securityContext:
runAsUser: {{ .Values.pod.user.glance.uid }}
command:
- /tmp/glance-api.sh
- start

2
glance/templates/deployment-registry.yaml
View File

@ -47,6 +47,8 @@ spec:
image: {{ .Values.images.registry }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.registry | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
securityContext:
runAsUser: {{ .Values.pod.user.glance.uid }}
command:
- /tmp/glance-registry.sh
- start

3
glance/values.yaml
View File

@ -318,6 +318,9 @@ endpoints:
default: 5672
pod:
user:
glance:
uid: 1000
affinity:
anti:
type:

2
heat/templates/deployment-api.yaml
View File

@ -47,6 +47,8 @@ spec:
image: {{ .Values.images.api }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
securityContext:
runAsUser: {{ .Values.pod.user.heat.uid }}
command:
- /tmp/heat-api.sh
- start

2
heat/templates/deployment-cfn.yaml
View File

@ -47,6 +47,8 @@ spec:
image: {{ .Values.images.cfn }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.cfn | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
securityContext:
runAsUser: {{ .Values.pod.user.heat.uid }}
command:
- /tmp/heat-cfn.sh
- start

2
heat/templates/deployment-cloudwatch.yaml
View File

@ -47,6 +47,8 @@ spec:
image: {{ .Values.images.cloudwatch }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.cloudwatch | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
securityContext:
runAsUser: {{ .Values.pod.user.heat.uid }}
command:
- /tmp/heat-cloudwatch.sh
- start

2
heat/templates/statefulset-engine.yaml
View File

@ -43,6 +43,8 @@ spec:
image: {{ .Values.images.engine }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.engine | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
securityContext:
runAsUser: {{ .Values.pod.user.heat.uid }}
command:
- /tmp/heat-engine.sh
volumeMounts:

3
heat/values.yaml
View File

@ -333,6 +333,9 @@ endpoints:
default: 5672
pod:
user:
heat:
uid: 1000
affinity:
anti:
type:

2
magnum/templates/deployment-api.yaml
View File

@ -47,6 +47,8 @@ spec:
image: {{ .Values.images.api }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
securityContext:
runAsUser: {{ .Values.pod.user.magnum.uid }}
command:
- /tmp/magnum-api.sh
- start

2
magnum/templates/statefulset-conductor.yaml
View File

@ -43,6 +43,8 @@ spec:
image: {{ .Values.images.conductor }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.conductor | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
securityContext:
runAsUser: {{ .Values.pod.user.magnum.uid }}
command:
- /tmp/magnum-conductor.sh
volumeMounts:

3
magnum/values.yaml
View File

@ -209,6 +209,9 @@ endpoints:
default: 5672
pod:
user:
magnum:
uid: 1000
affinity:
anti:
type:

3
mistral/values.yaml
View File

@ -240,6 +240,9 @@ conf:
memcache_security_strategy: ENCRYPT
pod:
user:
mistral:
uid: 1000
affinity:
anti:
type:

2
senlin/templates/deployment-api.yaml
View File

@ -47,6 +47,8 @@ spec:
image: {{ .Values.images.api }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
securityContext:
runAsUser: {{ .Values.pod.user.senlin.uid }}
command:
- /tmp/senlin-api.sh
- start

2
senlin/templates/statefulset-engine.yaml
View File

@ -43,6 +43,8 @@ spec:
image: {{ .Values.images.engine }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.engine | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
securityContext:
runAsUser: {{ .Values.pod.user.senlin.uid }}
command:
- /tmp/senlin-engine.sh
volumeMounts:

3
senlin/values.yaml
View File

@ -209,6 +209,9 @@ endpoints:
default: 5672
pod:
user:
senlin:
uid: 1000
affinity:
anti:
type: