Fix file permission and readOnly flag

This patchset enforces stricter file permission on *-etc configmap and
sets readOnly flag to true in a number of charts.

Change-Id: I233689a5d56dd1352e0d81997a94b4cdd6bed5d2
Signed-off-by: Tin Lam <tin@irrational.io>

barbican/templates/deployment-api.yaml

@@ -91,6 +91,7 @@ spec:
         - name: barbican-etc
           configMap:
             name: barbican-etc
+            defaultMode: 0444
         - name: barbican-bin
           configMap:
             name: barbican-bin

barbican/templates/job-db-init.yaml

@@ -45,12 +45,12 @@ spec:
           command:
             - /tmp/db-init.py
           volumeMounts:
+            - name: barbican-etc
+              mountPath: /etc/barbican
             - name: barbican-bin
               mountPath: /tmp/db-init.py
               subPath: db-init.py
               readOnly: true
-            - name: barbican-etc
-              mountPath: /etc/barbican
             - name: barbican-conf
               mountPath: /etc/barbican/barbican.conf
               subPath: barbican.conf
@@ -61,6 +61,7 @@ spec:
         - name: barbican-conf
           configMap:
             name: barbican-etc
+            defaultMode: 0444
         - name: barbican-bin
           configMap:
             name: barbican-bin

barbican/templates/job-db-sync.yaml

@@ -49,6 +49,7 @@ spec:
         - name: barbican-etc
           configMap:
             name: barbican-etc
+            defaultMode: 0444
         - name: barbican-bin
           configMap:
             name: barbican-bin

ceph/templates/daemonset-osd.yaml

@@ -114,6 +114,7 @@ spec:
         - name: ceph-etc
           configMap:
             name: ceph-etc
+            defaultMode: 0444
         - name: ceph-client-admin-keyring
           secret:
             secretName: {{ .Values.secrets.keyrings.admin }}

ceph/templates/deployment-mds.yaml

@@ -101,6 +101,7 @@ spec:
         - name: ceph-etc
           configMap:
             name: ceph-etc
+            defaultMode: 0444
         - name: ceph-client-admin-keyring
           secret:
             secretName: {{ .Values.secrets.keyrings.admin }}

ceph/templates/deployment-moncheck.yaml

@@ -92,6 +92,7 @@ spec:
         - name: ceph-etc
           configMap:
             name: ceph-etc
+            defaultMode: 0444
         - name: ceph-client-admin-keyring
           secret:
             secretName: {{ .Values.secrets.keyrings.admin }}

ceph/templates/deployment-rgw.yaml

@@ -104,6 +104,7 @@ spec:
         - name: ceph-etc
           configMap:
             name: ceph-etc
+            defaultMode: 0444
         - name: ceph-client-admin-keyring
           secret:
             secretName: {{ .Values.secrets.keyrings.admin }}

ceph/templates/job-keyring.yaml

@@ -81,5 +81,6 @@ spec:
         - name: ceph-templates
           configMap:
             name: ceph-templates
+            defaultMode: 0444
 {{ end }}
 {{ end }}

ceph/templates/job-storage-admin-keys.yaml

@@ -74,4 +74,5 @@ spec:
         - name: ceph-templates
           configMap:
             name: ceph-templates
+            defaultMode: 0444
 {{- end }}

ceph/templates/statefulset-mon.yaml

@@ -133,6 +133,7 @@ spec:
         - name: ceph-etc
           configMap:
             name: ceph-etc
+            defaultMode: 0444
         - name: ceph-client-admin-keyring
           secret:
             secretName: {{ .Values.secrets.keyrings.admin }}

cinder/templates/deployment-api.yaml

@@ -85,4 +85,5 @@ spec:
         - name: cinder-etc
           configMap:
             name: cinder-etc
+            defaultMode: 0444
 {{- if $mounts_cinder_api.volumes }}{{ toYaml $mounts_cinder_api.volumes | indent 8 }}{{ end }}

cinder/templates/deployment-backup.yaml

@@ -88,6 +88,7 @@ spec:
         - name: cinder-etc
           configMap:
             name: cinder-etc
+            defaultMode: 0444
         - name: cinder-bin
           configMap:
             name: cinder-bin
@@ -98,6 +99,7 @@ spec:
         - name: ceph-etc
           configMap:
             name: ceph-etc
+            defaultMode: 0444
         - name: ceph-keyring
           secret:
             secretName: pvc-ceph-client-key

cinder/templates/deployment-scheduler.yaml

@@ -71,4 +71,5 @@ spec:
         - name: cinder-etc
           configMap:
             name: cinder-etc
+            defaultMode: 0444
 {{- if $mounts_cinder_scheduler.volumes }}{{ toYaml $mounts_cinder_scheduler.volumes | indent 8 }}{{ end }}

cinder/templates/deployment-volume.yaml

@@ -102,6 +102,7 @@ spec:
         - name: ceph-etc
           configMap:
             name: ceph-etc
+            defaultMode: 0444
         - name: ceph-keyring
           secret:
             secretName: pvc-ceph-client-key

cinder/templates/job-bootstrap.yaml

@@ -43,13 +43,16 @@ spec:
             - name: cinder-etc
               mountPath: /etc/cinder/cinder.conf
               subPath: cinder.conf
+              readOnly: true
             - name: cinder-bin
               mountPath: /tmp/bootstrap.sh
               subPath: bootstrap.sh
+              readOnly: true
       volumes:
         - name: cinder-etc
           configMap:
             name: cinder-etc
+            defaultMode: 0444
         - name: cinder-bin
           configMap:
             name: cinder-bin

cinder/templates/job-db-init.yaml

@@ -63,6 +63,7 @@ spec:
         - name: cinder-etc
           configMap:
             name: cinder-etc
+            defaultMode: 0444
         - name: cinder-bin
           configMap:
             name: cinder-bin

cinder/templates/pod-rally-test.yaml

@@ -56,6 +56,7 @@ spec:
     - name: cinder-etc
       configMap:
         name: cinder-etc
+        defaultMode: 0444
     - name: cinder-bin
       configMap:
         name: cinder-bin

glance/templates/deployment-api.yaml

@@ -67,6 +67,7 @@ spec:
             - name: glance-bin
               mountPath: /tmp/ceph-keyring.sh
               subPath: ceph-keyring.sh
+              readOnly: true
             - name: ceph-keyring
               mountPath: /tmp/client-keyring
               subPath: key
@@ -136,6 +137,7 @@ spec:
         - name: glance-etc
           configMap:
             name: glance-etc
+            defaultMode: 0444
 {{- if eq .Values.storage "pvc" }}
         - name: glance-images
           persistentVolumeClaim:
@@ -146,6 +148,7 @@ spec:
         - name: ceph-etc
           configMap:
             name: ceph-etc
+            defaultMode: 0444
         - name: ceph-keyring
           secret:
             secretName: pvc-ceph-client-key

glance/templates/deployment-registry.yaml

@@ -88,4 +88,5 @@ spec:
         - name: glance-etc
           configMap:
             name: glance-etc
+            defaultMode: 0444
 {{- if $mounts_glance_registry.volumes }}{{ toYaml $mounts_glance_registry.volumes | indent 8 }}{{ end }}

glance/templates/job-bootstrap.yaml

@@ -59,3 +59,4 @@ spec:
         - name: glance-etc
           configMap:
             name: glance-etc
+            defaultMode: 0444

glance/templates/job-db-init.yaml

@@ -63,6 +63,7 @@ spec:
         - name: glance-etc
           configMap:
             name: glance-etc
+            defaultMode: 0444
         - name: glance-bin
           configMap:
             name: glance-bin

glance/templates/job-db-sync.yaml

@@ -51,6 +51,7 @@ spec:
         - name: glance-etc
           configMap:
             name: glance-etc
+            defaultMode: 0444
         - name: glance-bin
           configMap:
             name: glance-bin

glance/templates/pod-rally-test.yaml

@@ -56,6 +56,7 @@ spec:
     - name: glance-etc
       configMap:
         name: glance-etc
+        defaultMode: 0444
     - name: glance-bin
       configMap:
         name: glance-bin

heat/templates/deployment-api.yaml

@@ -92,4 +92,5 @@ spec:
         - name: heat-etc
           configMap:
             name: heat-etc
+            defaultMode: 0444
 {{- if $mounts_heat_api.volumes }}{{ toYaml $mounts_heat_api.volumes | indent 8 }}{{ end }}

heat/templates/deployment-cfn.yaml

@@ -92,4 +92,5 @@ spec:
         - name: heat-etc
           configMap:
             name: heat-etc
+            defaultMode: 0444
 {{- if $mounts_heat_cfn.volumes }}{{ toYaml $mounts_heat_cfn.volumes | indent 8 }}{{ end }}

heat/templates/deployment-cloudwatch.yaml

@@ -92,4 +92,5 @@ spec:
         - name: heat-etc
           configMap:
             name: heat-etc
+            defaultMode: 0444
 {{- if $mounts_heat_cloudwatch.volumes }}{{ toYaml $mounts_heat_cloudwatch.volumes | indent 8 }}{{ end }}

heat/templates/job-db-init.yaml

@@ -63,6 +63,7 @@ spec:
         - name: heat-etc
           configMap:
             name: heat-etc
+            defaultMode: 0444
         - name: heat-bin
           configMap:
             name: heat-bin

heat/templates/job-db-sync.yaml

@@ -51,6 +51,7 @@ spec:
         - name: heat-etc
           configMap:
             name: heat-etc
+            defaultMode: 0444
         - name: heat-bin
           configMap:
             name: heat-bin

heat/templates/statefulset-engine.yaml

@@ -72,4 +72,5 @@ spec:
         - name: heat-etc
           configMap:
             name: heat-etc
+            defaultMode: 0444
 {{- if $mounts_heat_engine.volumes }}{{ toYaml $mounts_heat_engine.volumes | indent 8 }}{{ end }}

horizon/templates/deployment.yaml

@@ -82,4 +82,5 @@ spec:
         - name: horizon-etc
           configMap:
             name: horizon-etc
+            defaultMode: 0444
 {{- if $mounts_horizon.volumes }}{{ toYaml $mounts_horizon.volumes | indent 8 }}{{ end }}

ingress/templates/deployment-ingress.yaml

@@ -74,8 +74,10 @@ spec:
             - name: ingress-etc
               mountPath: /etc/resolv.conf
               subPath: resolv.conf
+              readOnly: true
       volumes:
         - name: ingress-etc
           configMap:
             name: ingress-etc
+            defaultMode: 0444
 {{- end }}

keystone/templates/deployment.yaml

@@ -103,6 +103,7 @@ spec:
       - name: keystone-etc
         configMap:
           name: keystone-etc
+          defaultMode: 0444
       - name: keystone-bin
         configMap:
           name: keystone-bin

keystone/templates/job-bootstrap.yaml

@@ -45,6 +45,7 @@ spec:
             - name: keystone-bin
               mountPath: /tmp/bootstrap.sh
               subPath: bootstrap.sh
+              readOnly: true
 {{- if $mounts_keystone_bootstrap.volumeMounts }}{{ toYaml $mounts_keystone_bootstrap.volumeMounts | indent 10 }}{{ end }}
       volumes:
         - name: keystone-bin

keystone/templates/job-db-init.yaml

@@ -67,6 +67,7 @@ spec:
       - name: keystone-etc
         configMap:
           name: keystone-etc
+          defaultMode: 0444
       - name: keystone-bin
         configMap:
           name: keystone-bin

keystone/templates/job-db-sync.yaml

@@ -66,6 +66,7 @@ spec:
       - name: keystone-etc
         configMap:
           name: keystone-etc
+          defaultMode: 0444
       - name: keystone-bin
         configMap:
           name: keystone-bin

keystone/templates/pod-rally-test.yaml

@@ -56,6 +56,7 @@ spec:
     - name: keystone-etc
       configMap:
         name: keystone-etc
+        defaultMode: 0444
     - name: keystone-bin
       configMap:
         name: keystone-bin

magnum/templates/deployment-api.yaml

@@ -92,4 +92,5 @@ spec:
         - name: magnum-etc
           configMap:
             name: magnum-etc
+            defaultMode: 0444
 {{- if $mounts_magnum_api.volumes }}{{ toYaml $mounts_magnum_api.volumes | indent 8 }}{{ end }}

magnum/templates/job-db-init.yaml

@@ -63,6 +63,7 @@ spec:
         - name: magnum-etc
           configMap:
             name: magnum-etc
+            defaultMode: 0444
         - name: magnum-bin
           configMap:
             name: magnum-bin

magnum/templates/job-db-sync.yaml

@@ -51,6 +51,7 @@ spec:
         - name: magnum-etc
           configMap:
             name: magnum-etc
+            defaultMode: 0444
         - name: magnum-bin
           configMap:
             name: magnum-bin

magnum/templates/statefulset-conductor.yaml

@@ -72,4 +72,5 @@ spec:
         - name: magnum-etc
           configMap:
             name: magnum-etc
+            defaultMode: 0444
 {{- if $mounts_magnum_conductor.volumes }}{{ toYaml $mounts_magnum_conductor.volumes | indent 8 }}{{ end }}

mariadb/templates/statefulset.yaml

@@ -100,6 +100,7 @@ spec:
         - name: mariadb-etc
           configMap:
             name: mariadb-etc
+            defaultMode: 0444
         {{- if not .Values.volume.enabled }}
         - name: mysql-data
           emptyDir: {}

mistral/templates/deployment-api.yaml

@@ -85,4 +85,5 @@ spec:
         - name: mistral-etc
           configMap:
             name: mistral-etc
+            defaultMode: 0444
 {{- if $mounts_mistral_api.volumes }}{{ toYaml $mounts_mistral_api.volumes | indent 8 }}{{ end }}

mistral/templates/deployment-executor.yaml

@@ -67,4 +67,5 @@ spec:
         - name: mistral-etc
           configMap:
             name: mistral-etc
+            defaultMode: 0444
 {{- if $mounts_mistral_executor.volumes }}{{ toYaml $mounts_mistral_executor.volumes | indent 8 }}{{ end }}

mistral/templates/job-db-init.yaml

@@ -67,3 +67,4 @@ spec:
         - name: mistral-etc
           configMap:
             name: mistral-etc
+            defaultMode: 0444

mistral/templates/job-db-sync.yaml

@@ -51,6 +51,7 @@ spec:
         - name: mistral-etc
           configMap:
             name: mistral-etc
+            defaultMode: 0444
         - name: mistral-bin
           configMap:
             name: mistral-bin

mistral/templates/statefulset-engine.yaml

@@ -62,4 +62,5 @@ spec:
         - name: mistral-etc
           configMap:
             name: mistral-etc
+            defaultMode: 0444
 {{- if $mounts_mistral_engine.volumes }}{{ toYaml $mounts_mistral_engine.volumes | indent 8 }}{{ end }}

mistral/templates/statefulset-event-engine.yaml

@@ -64,4 +64,5 @@ spec:
         - name: mistral-etc
           configMap:
             name: mistral-etc
+            defaultMode: 0444
 {{- if $mounts_mistral_event_engine.volumes }}{{ toYaml $mounts_mistral_event_engine.volumes | indent 8 }}{{ end }}

neutron/templates/daemonset-dhcp-agent.yaml

@@ -90,6 +90,7 @@ spec:
         - name: neutron-etc
           configMap:
             name: neutron-etc
+            defaultMode: 0444
         - name: runopenvswitch
           hostPath:
             path: /run/openvswitch

neutron/templates/daemonset-l3-agent.yaml

@@ -89,6 +89,7 @@ spec:
         - name: neutron-etc
           configMap:
             name: neutron-etc
+            defaultMode: 0444
         - name: runopenvswitch
           hostPath:
             path: /run/openvswitch

neutron/templates/daemonset-metadata-agent.yaml

@@ -88,6 +88,7 @@ spec:
         - name: neutron-etc
           configMap:
             name: neutron-etc
+            defaultMode: 0444
         - name: runopenvswitch
           hostPath:
             path: /run/openvswitch

neutron/templates/daemonset-ovs-agent.yaml

@@ -131,6 +131,7 @@ spec:
         - name: neutron-etc
           configMap:
             name: neutron-etc
+            defaultMode: 0444
         - name: libmodules
           hostPath:
             path: /lib/modules

neutron/templates/daemonset-ovs-db.yaml

@@ -66,6 +66,7 @@ spec:
         - name: neutron-etc
           configMap:
             name: neutron-etc
+            defaultMode: 0444
         - name: libmodules
           hostPath:
             path: /lib/modules

neutron/templates/deployment-server.yaml

@@ -88,4 +88,5 @@ spec:
         - name: neutron-etc
           configMap:
             name: neutron-etc
+            defaultMode: 0444
 {{- if $mounts_neutron_server.volumes }}{{ toYaml $mounts_neutron_server.volumes | indent 8 }}{{ end }}

neutron/templates/job-db-init.yaml

@@ -63,6 +63,7 @@ spec:
         - name: neutron-etc
           configMap:
             name: neutron-etc
+            defaultMode: 0444
         - name: neutron-bin
           configMap:
             name: neutron-bin

neutron/templates/job-db-sync.yaml

@@ -64,6 +64,7 @@ spec:
         - name: neutron-etc
           configMap:
             name: neutron-etc
+            defaultMode: 0444
         - name: neutron-bin
           configMap:
             name: neutron-bin

neutron/templates/pod-rally-test.yaml

@@ -56,6 +56,7 @@ spec:
     - name: neutron-etc
       configMap:
         name: neutron-etc
+        defaultMode: 0444
     - name: neutron-bin
       configMap:
         name: neutron-bin

nova/templates/daemonset-compute.yaml

@@ -167,12 +167,14 @@ spec:
         - name: nova-etc
           configMap:
             name: nova-etc
+            defaultMode: 0444
         {{- if .Values.ceph.enabled }}
         - name: etcceph
           emptyDir: {}
         - name: ceph-etc
           configMap:
             name: ceph-etc
+            defaultMode: 0444
         - name: ceph-keyring
           secret:
             secretName: pvc-ceph-client-key

nova/templates/daemonset-libvirt.yaml

@@ -52,6 +52,7 @@ spec:
             - name: nova-bin
               mountPath: /tmp/ceph-keyring.sh
               subPath: ceph-keyring.sh
+              readOnly: true
             - name: ceph-keyring
               mountPath: /tmp/client-keyring
               subPath: key
@@ -136,12 +137,14 @@ spec:
         - name: nova-etc
           configMap:
             name: nova-etc
+            defaultMode: 0444
         {{- if .Values.ceph.enabled }}
         - name: etcceph
           emptyDir: {}
         - name: ceph-etc
           configMap:
             name: ceph-etc
+            defaultMode: 0444
         - name: ceph-keyring
           secret:
             secretName: pvc-ceph-client-key

nova/templates/deployment-api-metadata.yaml

@@ -96,4 +96,5 @@ spec:
         - name: nova-etc
           configMap:
             name: nova-etc
+            defaultMode: 0444
 {{- if $mounts_nova_api_metadata.volumes }}{{ toYaml $mounts_nova_api_metadata.volumes | indent 8 }}{{ end }}

nova/templates/deployment-api-osapi.yaml

@@ -84,4 +84,5 @@ spec:
         - name: nova-etc
           configMap:
             name: nova-etc
+            defaultMode: 0444
 {{- if $mounts_nova_api_osapi.volumes}}{{ toYaml $mounts_nova_api_osapi.volumes | indent 8 }}{{ end }}

nova/templates/deployment-conductor.yaml

@@ -67,4 +67,5 @@ spec:
         - name: nova-etc
           configMap:
             name: nova-etc
+            defaultMode: 0444
 {{- if $mounts_nova_conductor.volumes }}{{ toYaml $mounts_nova_conductor.volumes | indent 8 }}{{ end }}

nova/templates/deployment-consoleauth.yaml

@@ -67,4 +67,5 @@ spec:
         - name: nova-etc
           configMap:
             name: nova-etc
+            defaultMode: 0444
 {{- if $mounts_nova_consoleauth.volumes }}{{ toYaml $mounts_nova_consoleauth.volumes | indent 8 }}{{ end }}

nova/templates/deployment-scheduler.yaml

@@ -67,4 +67,5 @@ spec:
         - name: nova-etc
           configMap:
             name: nova-etc
+            defaultMode: 0444
 {{- if $mounts_nova_scheduler.volumes }}{{ toYaml $mounts_nova_scheduler.volumes | indent 8 }}{{ end }}

nova/templates/job-bootstrap.yaml

@@ -54,6 +54,7 @@ spec:
         - name: nova-etc
           configMap:
             name: nova-etc
+            defaultMode: 0444
         - name: nova-bin
           configMap:
             name: nova-bin

nova/templates/job-db-init.yaml

@@ -92,6 +92,7 @@ spec:
         - name: nova-etc
           configMap:
             name: nova-etc
+            defaultMode: 0444
         - name: nova-bin
           configMap:
             name: nova-bin

nova/templates/job-db-sync.yaml

@@ -51,6 +51,7 @@ spec:
         - name: nova-etc
           configMap:
             name: nova-etc
+            defaultMode: 0444
         - name: nova-bin
           configMap:
             name: nova-bin

nova/templates/pod-rally-test.yaml

@@ -54,6 +54,7 @@ spec:
     - name: nova-etc
       configMap:
         name: nova-etc
+        defaultMode: 0444
     - name: nova-bin
       configMap:
         name: nova-bin

rabbitmq/templates/deployment.yaml

@@ -40,15 +40,6 @@ spec:
 {{ tuple $envAll "rabbitmq" "server" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
       nodeSelector:
         {{ .Values.labels.node_selector_key }}: {{ .Values.labels.node_selector_value }}
-      volumes:
-        - name: rabbitmq-emptydir
-          emptyDir: {}
-        - name: rabbitmq-bin
-          configMap:
-            name: rabbitmq-bin
-        - name: rabbitmq-etc
-          configMap:
-            name: rabbitmq-etc
       initContainers:
 {{ tuple $envAll $dependencies "[]" | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 9 }}
       containers:
@@ -105,3 +96,14 @@ spec:
               mountPath: /etc/rabbitmq/rabbitmq.config
               subPath: rabbitmq.config
               readOnly: true
+      volumes:
+        - name: rabbitmq-emptydir
+          emptyDir: {}
+        - name: rabbitmq-bin
+          configMap:
+            name: rabbitmq-bin
+            defaultMode: 0555
+        - name: rabbitmq-etc
+          configMap:
+            name: rabbitmq-etc
+            defaultMode: 0444

senlin/templates/deployment-api.yaml

@@ -92,4 +92,5 @@ spec:
         - name: senlin-etc
           configMap:
             name: senlin-etc
+            defaultMode: 0444
 {{- if $mounts_senlin_api.volumes }}{{ toYaml $mounts_senlin_api.volumes | indent 8 }}{{ end }}

senlin/templates/job-db-init.yaml

@@ -63,6 +63,7 @@ spec:
         - name: senlin-etc
           configMap:
             name: senlin-etc
+            defaultMode: 0444
         - name: senlin-bin
           configMap:
             name: senlin-bin

senlin/templates/job-db-sync.yaml

@@ -51,6 +51,7 @@ spec:
         - name: senlin-etc
           configMap:
             name: senlin-etc
+            defaultMode: 0444
         - name: senlin-bin
           configMap:
             name: senlin-bin

senlin/templates/statefulset-engine.yaml

@@ -72,4 +72,5 @@ spec:
         - name: senlin-etc
           configMap:
             name: senlin-etc
+            defaultMode: 0444
 {{- if $mounts_senlin_engine.volumes }}{{ toYaml $mounts_senlin_engine.volumes | indent 8 }}{{ end }}