openstack/openstack-helm
Code Issues Proposed changes

Merge "Add missing security context to Barbican test pods/containers"

Browse Source
This commit is contained in:
Zuul 2020-07-13 19:00:48 +00:00 committed by Gerrit Code Review
commit 61a61d9de1
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
barbican/templates/pod-test.yaml
View File

@ -34,6 +34,7 @@ metadata:
{{ dict "envAll" $envAll "podName" "barbican-test" "containerNames" (list "init" "barbican-test") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 4 }} {{ dict "envAll" $envAll "podName" "barbican-test" "containerNames" (list "init" "barbican-test") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 4 }}
spec: spec:
serviceAccountName: {{ $serviceAccountName }} serviceAccountName: {{ $serviceAccountName }}
{{ dict "envAll" $envAll "application" "test" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 2 }}
nodeSelector: nodeSelector:
{{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }} {{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }}
restartPolicy: Never restartPolicy: Never
@ -42,6 +43,7 @@ spec:
containers: containers:
- name: barbican-test - name: barbican-test
{{ tuple $envAll "scripted_test" | include "helm-toolkit.snippets.image" | indent 6 }} {{ tuple $envAll "scripted_test" | include "helm-toolkit.snippets.image" | indent 6 }}
{{ dict "envAll" $envAll "application" "test" "container" "barbican_test" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 6 }}
env: env:
{{- with $env := dict "ksUserSecret" .Values.secrets.identity.admin }} {{- with $env := dict "ksUserSecret" .Values.secrets.identity.admin }}
{{- include "helm-toolkit.snippets.keystone_openrc_env_vars" $env | indent 8 }} {{- include "helm-toolkit.snippets.keystone_openrc_env_vars" $env | indent 8 }}

7
barbican/values.yaml
View File

@ -59,6 +59,13 @@ pod:
barbican_api: barbican_api:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
test:
pod:
runAsUser: 42424
container:
barbican_test:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
affinity: affinity:
anti: anti:
type: type: