Undo octal-values restriction together with corresponding code

Unrestrict octal values rule since benefits of file modes readability
exceed possible issues with yaml 1.2 adoption in future k8s versions.
These issues will be addressed when/if they occur.

Also ensure osh-infra is a required project for lint job, that matters
when running job against another project.

Change-Id: Ic5e327cf40c4b09c90738baff56419a6cef132da
Signed-off-by: Andrii Ostapenko <andrii.ostapenko@att.com>

calico/templates/daemonset-calico-node.yaml

@@ -285,15 +285,15 @@ spec:
         - name: calico-etc
           configMap:
             name: calico-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: calico-bird
           configMap:
             name: calico-bird
-            defaultMode: 292
+            defaultMode: 0444
         - name: calico-bin
           configMap:
             name: calico-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: calico-etcd-secrets
           secret:
             secretName: calico-etcd-secrets

calico/templates/deployment-calico-kube-controllers.yaml

@@ -172,5 +172,5 @@ spec:
         - name: calico-etcd-secrets
           secret:
             secretName: calico-etcd-secrets
-            defaultMode: 256
+            defaultMode: 0400
 {{- end }}

calico/templates/job-calico-settings.yaml

@@ -100,7 +100,7 @@ spec:
         - name: calico-bin
           configMap:
             name: calico-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: calico-etcd-secrets
           secret:
             secretName: calico-etcd-secrets

ceph-client/templates/cronjob-checkPGs.yaml

@@ -129,11 +129,11 @@ spec:
             - name: ceph-client-bin
               configMap:
                 name: ceph-client-bin
-                defaultMode: 365
+                defaultMode: 0555
             - name: ceph-client-etc
               configMap:
                 name: ceph-client-etc
-                defaultMode: 292
+                defaultMode: 0444
             - name: ceph-client-admin-keyring
               secret:
                 defaultMode: 420

ceph-client/templates/cronjob-defragosds.yaml

@@ -106,5 +106,5 @@ spec:
             - name: ceph-client-bin
               configMap:
                 name: ceph-client-bin
-                defaultMode: 365
+                defaultMode: 0555
 {{- end }}

ceph-client/templates/deployment-checkdns.yaml

@@ -115,5 +115,5 @@ spec:
         - name: ceph-client-bin
           configMap:
             name: ceph-client-bin
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

ceph-client/templates/deployment-mds.yaml

@@ -147,11 +147,11 @@ spec:
         - name: ceph-client-etc
           configMap:
             name: ceph-client-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: ceph-client-bin
           configMap:
             name: ceph-client-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: pod-var-lib-ceph
           emptyDir: {}
         - name: ceph-client-admin-keyring

ceph-client/templates/deployment-mgr.yaml

@@ -184,11 +184,11 @@ spec:
         - name: ceph-client-bin
           configMap:
             name: ceph-client-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: ceph-client-etc
           configMap:
             name: ceph-client-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: pod-var-lib-ceph
           emptyDir: {}
         - name: ceph-client-admin-keyring

ceph-client/templates/job-bootstrap.yaml

@@ -70,11 +70,11 @@ spec:
         - name: ceph-client-bin
           configMap:
             name: ceph-client-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: ceph-client-etc
           configMap:
             name: ceph-client-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: ceph-client-admin-keyring
           secret:
             secretName: {{ .Values.secrets.keyrings.admin }}

ceph-client/templates/job-rbd-pool.yaml

@@ -89,11 +89,11 @@ spec:
         - name: ceph-client-etc
           configMap:
             name: ceph-client-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: ceph-client-bin
           configMap:
             name: ceph-client-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: pod-var-lib-ceph
           emptyDir: {}
         - name: pod-run

ceph-client/templates/pod-helm-tests.yaml

@@ -81,12 +81,12 @@ spec:
     - name: ceph-client-bin
       configMap:
         name: ceph-client-bin
-        defaultMode: 365
+        defaultMode: 0555
     - name: ceph-client-admin-keyring
       secret:
         secretName: {{ .Values.secrets.keyrings.admin }}
     - name: ceph-client-etc
       configMap:
         name: ceph-client-etc
-        defaultMode: 292
+        defaultMode: 0444
 {{- end }}

ceph-mon/templates/daemonset-mon.yaml

@@ -243,11 +243,11 @@ spec:
         - name: ceph-mon-bin
           configMap:
             name: ceph-mon-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: ceph-mon-etc
           configMap:
             name: ceph-mon-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: pod-var-lib-ceph
           hostPath:
             path: {{ .Values.conf.storage.mon.directory }}

ceph-mon/templates/deployment-moncheck.yaml

@@ -114,11 +114,11 @@ spec:
         - name: ceph-mon-etc
           configMap:
             name: ceph-mon-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: ceph-mon-bin
           configMap:
             name: ceph-mon-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: pod-var-lib-ceph
           emptyDir: {}
         - name: ceph-client-admin-keyring

ceph-mon/templates/job-bootstrap.yaml

@@ -72,11 +72,11 @@ spec:
         - name: ceph-mon-bin
           configMap:
             name: ceph-mon-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: ceph-mon-etc
           configMap:
             name: ceph-mon-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: ceph-client-admin-keyring
           secret:
             secretName: {{ .Values.secrets.keyrings.admin }}

ceph-mon/templates/job-keyring.yaml

@@ -120,10 +120,10 @@ spec:
         - name: ceph-mon-bin
           configMap:
             name: ceph-mon-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: ceph-templates
           configMap:
             name: ceph-templates
-            defaultMode: 292
+            defaultMode: 0444
 {{- end }}
 {{- end }}

ceph-mon/templates/job-storage-admin-keys.yaml

@@ -117,9 +117,9 @@ spec:
         - name: ceph-mon-bin
           configMap:
             name: ceph-mon-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: ceph-templates
           configMap:
             name: ceph-templates
-            defaultMode: 292
+            defaultMode: 0444
 {{- end }}

ceph-osd/templates/daemonset-osd.yaml

@@ -436,11 +436,11 @@ spec:
         - name: ceph-osd-bin
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "bin" | quote }}
-            defaultMode: 365
+            defaultMode: 0555
         - name: ceph-osd-etc
           configMap:
             name: {{ $configMapName }}
-            defaultMode: 292
+            defaultMode: 0444
         - name: ceph-bootstrap-osd-keyring
           secret:
             secretName: {{ .Values.secrets.keyrings.osd }}

ceph-osd/templates/job-bootstrap.yaml

@@ -69,11 +69,11 @@ spec:
         - name: ceph-osd-bin
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "bin" | quote }}
-            defaultMode: 365
+            defaultMode: 0555
         - name: ceph-osd-etc
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "etc" | quote }}
-            defaultMode: 292
+            defaultMode: 0444
         - name: ceph-osd-admin-keyring
           secret:
             secretName: {{ .Values.secrets.keyrings.admin }}

ceph-osd/templates/job-post-apply.yaml

@@ -126,11 +126,11 @@ spec:
         - name: ceph-osd-bin
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "bin" | quote }}
-            defaultMode: 365
+            defaultMode: 0555
         - name: ceph-osd-etc
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "etc" | quote }}
-            defaultMode: 292
+            defaultMode: 0444
         - name: ceph-osd-admin-keyring
           secret:
             secretName: {{ .Values.secrets.keyrings.admin }}

ceph-osd/templates/pod-helm-tests.yaml

@@ -72,12 +72,12 @@ spec:
     - name: ceph-osd-bin
       configMap:
         name: {{ printf "%s-%s" $envAll.Release.Name "bin" | quote }}
-        defaultMode: 365
+        defaultMode: 0555
     - name: ceph-client-admin-keyring
       secret:
         secretName: {{ .Values.secrets.keyrings.admin }}
     - name: ceph-osd-etc
       configMap:
         name: {{ printf "%s-%s" $envAll.Release.Name "etc" | quote }}
-        defaultMode: 292
+        defaultMode: 0444
 {{- end }}

ceph-provisioners/templates/deployment-cephfs-provisioner.yaml

@@ -197,5 +197,5 @@ spec:
         - name: ceph-provisioners-bin
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "ceph-prov-bin" | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

ceph-provisioners/templates/deployment-rbd-provisioner.yaml

@@ -187,5 +187,5 @@ spec:
         - name: ceph-provisioners-bin
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "ceph-prov-bin" | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

ceph-provisioners/templates/job-bootstrap.yaml

@@ -69,11 +69,11 @@ spec:
         - name: ceph-provisioners-bin
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "ceph-prov-bin" | quote }}
-            defaultMode: 365
+            defaultMode: 0555
         - name: ceph-etc
           configMap:
             name: {{ .Values.storageclass.rbd.ceph_configmap_name }}
-            defaultMode: 292
+            defaultMode: 0444
         - name: ceph-client-admin-keyring
           secret:
             secretName: {{ .Values.secrets.keyrings.admin }}

ceph-provisioners/templates/job-cephfs-client-key.yaml

@@ -132,5 +132,5 @@ spec:
         - name: ceph-provisioners-bin
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "ceph-prov-bin" | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

ceph-provisioners/templates/job-namespace-client-key-cleaner.yaml

@@ -97,5 +97,5 @@ spec:
         - name: ceph-provisioners-bin-clients
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "ceph-prov-bin-clients" | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

ceph-provisioners/templates/job-namespace-client-key.yaml

@@ -128,5 +128,5 @@ spec:
         - name: ceph-provisioners-bin-clients
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "ceph-prov-bin-clients" | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

ceph-provisioners/templates/pod-helm-tests.yaml

@@ -107,7 +107,7 @@ spec:
     - name: ceph-provisioners-bin-clients
       configMap:
         name: {{ printf "%s-%s" $envAll.Release.Name "ceph-prov-bin-clients" | quote }}
-        defaultMode: 365
+        defaultMode: 0555
     - name: pod-tmp
       emptyDir: {}
 {{- end }}

ceph-rgw/templates/deployment-rgw.yaml

@@ -181,11 +181,11 @@ spec:
         - name: ceph-rgw-bin
           configMap:
             name: ceph-rgw-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: ceph-rgw-etc
           configMap:
             name: ceph-rgw-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: pod-var-lib-ceph
           emptyDir: {}
         - name: ceph-bootstrap-rgw-keyring

ceph-rgw/templates/job-bootstrap.yaml

@@ -118,11 +118,11 @@ spec:
         - name: ceph-rgw-bin
           configMap:
             name: ceph-rgw-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: ceph-rgw-etc
           configMap:
             name: {{ .Values.ceph_client.configmap }}
-            defaultMode: 292
+            defaultMode: 0444
         - name: ceph-rgw-admin-keyring
           secret:
             secretName: {{ .Values.secrets.keyrings.admin | quote }}

ceph-rgw/templates/job-rgw-storage-init.yaml

@@ -126,15 +126,15 @@ spec:
         - name: ceph-rgw-bin
           configMap:
             name: ceph-rgw-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: ceph-etc
           configMap:
             name: {{ .Values.ceph_client.configmap }}
-            defaultMode: 292
+            defaultMode: 0444
         - name: ceph-templates
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "ceph-templates" | quote }}
-            defaultMode: 292
+            defaultMode: 0444
         - name: ceph-keyring
           secret:
             secretName: {{ .Values.secrets.keyrings.admin | quote }}

ceph-rgw/templates/job-s3-admin.yaml

@@ -137,11 +137,11 @@ spec:
         - name: ceph-rgw-bin
           configMap:
             name: ceph-rgw-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: ceph-rgw-etc
           configMap:
             name: ceph-rgw-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: ceph-keyring
           secret:
             secretName: {{ .Values.secrets.keyrings.admin | quote }}

ceph-rgw/templates/pod-helm-tests.yaml

@@ -104,12 +104,12 @@ spec:
     - name: ceph-rgw-bin
       configMap:
         name: ceph-rgw-bin
-        defaultMode: 365
+        defaultMode: 0555
     - name: ceph-keyring
       secret:
         secretName: {{ .Values.secrets.keyrings.admin | quote }}
     - name: ceph-rgw-etc
       configMap:
         name: ceph-rgw-etc
-        defaultMode: 292
+        defaultMode: 0444
 {{- end }}

daemonjob-controller/templates/deployment.yaml

@@ -58,5 +58,5 @@ spec:
       - name: hooks
         configMap:
           name: daemonjob-controller-bin
-          defaultMode: 365
+          defaultMode: 0555
 {{- end }}

elastic-apm-server/templates/deployment.yaml

@@ -122,7 +122,7 @@ spec:
         - name: elastic-apm-server-etc
           configMap:
             name: elastic-apm-server-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: data
           hostPath:
             path: /var/lib/elastic-apm-server

elastic-filebeat/templates/daemonset.yaml

@@ -157,7 +157,7 @@ spec:
         - name: filebeat-etc
           configMap:
             name: filebeat-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: data
           hostPath:
             path: /var/lib/filebeat

elastic-metricbeat/templates/daemonset-node-metrics.yaml

@@ -168,7 +168,7 @@ spec:
             path: /var/run/docker.sock
         - name: metricbeat-etc
           configMap:
-            defaultMode: 292
+            defaultMode: 0444
             name: metricbeat-etc
         - name: data
           emptyDir: {}

elastic-metricbeat/templates/deployment-modules.yaml

@@ -154,5 +154,5 @@ spec:
         - name: metricbeat-etc
           configMap:
             name: metricbeat-etc
-            defaultMode: 292
+            defaultMode: 0444
 {{- end }}

elastic-packetbeat/templates/daemonset.yaml

@@ -139,7 +139,7 @@ spec:
           emptyDir: {}
         - name: packetbeat-etc
           configMap:
-            defaultMode: 292
+            defaultMode: 0444
             name: packetbeat-etc
 {{ if $mounts_packetbeat.volumes }}{{ toYaml $mounts_packetbeat.volumes | indent 8 }}{{ end }}
 {{- end }}

elasticsearch/templates/cron-job-curator.yaml

@@ -86,9 +86,9 @@ spec:
             - name: elastic-curator-bin
               configMap:
                 name: elastic-curator-bin
-                defaultMode: 365
+                defaultMode: 0555
             - name: elastic-curator-etc
               secret:
                 secretName: elastic-curator-etc
-                defaultMode: 292
+                defaultMode: 0444
 {{- end }}

elasticsearch/templates/cron-job-verify-repositories.yaml

@@ -83,5 +83,5 @@ spec:
             - name: elasticsearch-bin
               configMap:
                 name: elasticsearch-bin
-                defaultMode: 365
+                defaultMode: 0555
 {{- end }}

elasticsearch/templates/deployment-client.yaml

@@ -210,11 +210,11 @@ spec:
         - name: elasticsearch-bin
           configMap:
             name: elasticsearch-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: elasticsearch-etc
           secret:
             secretName: elasticsearch-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: storage
           emptyDir: {}
 {{ if $mounts_elasticsearch.volumes }}{{ toYaml $mounts_elasticsearch.volumes | indent 8 }}{{ end }}

elasticsearch/templates/deployment-gateway.yaml

@@ -160,11 +160,11 @@ spec:
         - name: elasticsearch-bin
           configMap:
             name: elasticsearch-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: elasticsearch-etc
           secret:
             secretName: elasticsearch-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: storage
           emptyDir: {}
 {{ if $mounts_elasticsearch.volumes }}{{ toYaml $mounts_elasticsearch.volumes | indent 8 }}{{ end }}

elasticsearch/templates/job-elasticsearch-template.yaml

@@ -85,10 +85,10 @@ spec:
         - name: elasticsearch-bin
           configMap:
             name: elasticsearch-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: elasticsearch-templates-etc
           secret:
             secretName: elasticsearch-templates-etc
-            defaultMode: 292
+            defaultMode: 0444
 {{ if $mounts_elasticsearch_templates.volumes }}{{ toYaml $mounts_elasticsearch_templates.volumes | indent 8 }}{{ end }}
 {{- end }}

elasticsearch/templates/job-es-cluster-wait.yaml

@@ -76,5 +76,5 @@ spec:
         - name: elasticsearch-bin
           configMap:
             name: elasticsearch-bin
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

elasticsearch/templates/job-register-snapshot-repository.yaml

@@ -91,5 +91,5 @@ spec:
         - name: elasticsearch-bin
           configMap:
             name: elasticsearch-bin
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

elasticsearch/templates/pod-helm-tests.yaml

@@ -70,5 +70,5 @@ spec:
     - name: elasticsearch-bin
       configMap:
         name: elasticsearch-bin
-        defaultMode: 365
+        defaultMode: 0555
 {{- end }}

elasticsearch/templates/statefulset-data.yaml

@@ -175,11 +175,11 @@ spec:
         - name: elasticsearch-bin
           configMap:
             name: elasticsearch-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: elasticsearch-etc
           secret:
             secretName: elasticsearch-etc
-            defaultMode: 292
+            defaultMode: 0444
 {{ if $mounts_elasticsearch.volumes }}{{ toYaml $mounts_elasticsearch.volumes | indent 8 }}{{ end }}
 {{- if not .Values.storage.data.enabled }}
         - name: storage

elasticsearch/templates/statefulset-master.yaml

@@ -168,11 +168,11 @@ spec:
         - name: elasticsearch-bin
           configMap:
             name: elasticsearch-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: elasticsearch-etc
           secret:
             secretName: elasticsearch-etc
-            defaultMode: 292
+            defaultMode: 0444
 {{ if $mounts_elasticsearch.volumes }}{{ toYaml $mounts_elasticsearch.volumes | indent 8 }}{{ end }}
 {{- if not .Values.storage.master.enabled }}
         - name: storage

etcd/templates/deployment.yaml

@@ -70,5 +70,5 @@ spec:
         - name: etcd-bin
           configMap:
             name: {{ $configMapBinName | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

falco/templates/daemonset.yaml

@@ -119,7 +119,7 @@ spec:
         - name: falco-bin
           configMap:
             name: falco-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: dshm
           emptyDir:
             medium: Memory

fluentbit/templates/daemonset-fluent-bit.yaml

@@ -145,10 +145,10 @@ spec:
         - name: fluentbit-bin
           configMap:
             name: fluentbit-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: fluentbit-etc
           secret:
             secretName: fluentbit-etc
-            defaultMode: 292
+            defaultMode: 0444
 {{ if $mounts_fluentbit.volumes }}{{ toYaml $mounts_fluentbit.volumes | indent 8 }}{{ end }}
 {{- end }}

fluentd/templates/deployment-fluentd.yaml

@@ -226,15 +226,15 @@ spec:
         - name: {{ printf "%s-%s" $envAll.Release.Name "env-secret" | quote }}
           secret:
             secretName: {{ printf "%s-%s" $envAll.Release.Name "env-secret" | quote }}
-            defaultMode: 292
+            defaultMode: 0444
 {{- end }}
         - name: fluentd-etc
           secret:
             secretName: {{ printf "%s-%s" $envAll.Release.Name "fluentd-etc" | quote }}
-            defaultMode: 292
+            defaultMode: 0444
         - name: fluentd-bin
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "fluentd-bin" | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{ if $mounts_fluentd.volumes }}{{ toYaml $mounts_fluentd.volumes | indent 8 }}{{- end }}
 {{- end }}

gnocchi/templates/cron-job-resources-cleaner.yaml

@@ -94,10 +94,10 @@ spec:
             - name: gnocchi-etc
               secret:
                 secretName: gnocchi-etc
-                defaultMode: 292
+                defaultMode: 0444
             - name: gnocchi-bin
               configMap:
                 name: gnocchi-bin
-                defaultMode: 365
+                defaultMode: 0555
 {{ if $mounts_gnocchi_resources_cleaner.volumes }}{{ toYaml $mounts_gnocchi_resources_cleaner.volumes | indent 12 }}{{ end }}
 {{- end }}

gnocchi/templates/daemonset-metricd.yaml

@@ -105,11 +105,11 @@ spec:
         - name: gnocchi-etc
           secret:
             secretName: gnocchi-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: gnocchi-bin
           configMap:
             name: gnocchi-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: etcceph
           emptyDir: {}
         - name: ceph-etc

gnocchi/templates/daemonset-statsd.yaml

@@ -111,11 +111,11 @@ spec:
         - name: gnocchi-etc
           secret:
             secretName: gnocchi-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: gnocchi-bin
           configMap:
             name: gnocchi-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: etcceph
           emptyDir: {}
         - name: ceph-etc

gnocchi/templates/deployment-api.yaml

@@ -130,11 +130,11 @@ spec:
         - name: gnocchi-etc
           secret:
             secretName: gnocchi-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: gnocchi-bin
           configMap:
             name: gnocchi-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: etcceph
           emptyDir: {}
         - name: ceph-etc

gnocchi/templates/job-clean.yaml

@@ -89,5 +89,5 @@ spec:
         - name: gnocchi-bin
           configMap:
             name: gnocchi-bin
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

gnocchi/templates/job-db-init-indexer.yaml

@@ -70,11 +70,11 @@ spec:
         - name: gnocchi-etc
           secret:
             secretName: gnocchi-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: pod-etc-gnocchi
           emptyDir: {}
         - name: gnocchi-bin
           configMap:
             name: gnocchi-bin
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

gnocchi/templates/job-db-sync.yaml

@@ -82,11 +82,11 @@ spec:
         - name: gnocchi-etc
           secret:
             secretName: gnocchi-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: gnocchi-bin
           configMap:
             name: gnocchi-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: etcceph
           emptyDir: {}
         - name: ceph-etc

gnocchi/templates/job-storage-init.yaml

@@ -123,13 +123,13 @@ spec:
         - name: gnocchi-bin
           configMap:
             name: gnocchi-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: etcceph
           emptyDir: {}
         - name: ceph-etc
           configMap:
             name: {{ .Values.ceph_client.configmap }}
-            defaultMode: 292
+            defaultMode: 0444
         - name: ceph-keyring
           secret:
             secretName: {{ .Values.ceph_client.user_secret_name }}

gnocchi/templates/pod-gnocchi-test.yaml

@@ -74,10 +74,10 @@ spec:
     - name: gnocchi-etc
       secret:
         secretName: gnocchi-etc
-        defaultMode: 292
+        defaultMode: 0444
     - name: gnocchi-bin
       configMap:
         name: gnocchi-bin
-        defaultMode: 365
+        defaultMode: 0555
 {{ if $mounts_gnocchi_tests.volumes }}{{ toYaml $mounts_gnocchi_tests.volumes | indent 4 }}{{ end }}
 {{- end }}

grafana/templates/deployment.yaml

@@ -133,15 +133,15 @@ spec:
         - name: grafana-bin
           configMap:
             name: grafana-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: grafana-etc
           secret:
             secretName: grafana-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: grafana-dashboards
           configMap:
             name: grafana-dashboards
-            defaultMode: 365
+            defaultMode: 0555
         - name: data
           emptyDir: {}
 {{ if $mounts_grafana.volumes }}{{ toYaml $mounts_grafana.volumes | indent 8 }}{{ end }}

grafana/templates/job-add-home-dashboard.yaml

@@ -74,5 +74,5 @@ spec:
         - name: grafana-bin
           configMap:
             name: grafana-bin
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

grafana/templates/job-db-init-session.yaml

@@ -72,5 +72,5 @@ spec:
         - name: grafana-bin
           configMap:
             name: grafana-bin
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

grafana/templates/job-db-init.yaml

@@ -72,5 +72,5 @@ spec:
         - name: grafana-bin
           configMap:
             name: grafana-bin
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

grafana/templates/job-db-session-sync.yaml

@@ -67,5 +67,5 @@ spec:
         - name: grafana-bin
           configMap:
             name: grafana-bin
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

grafana/templates/job-set-admin-user.yaml

@@ -77,9 +77,9 @@ spec:
         - name: grafana-bin
           configMap:
             name: grafana-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: grafana-etc
           secret:
             secretName: grafana-etc
-            defaultMode: 292
+            defaultMode: 0444
 {{- end }}

grafana/templates/pod-helm-tests.yaml

@@ -70,5 +70,5 @@ spec:
     - name: grafana-bin
       configMap:
         name: grafana-bin
-        defaultMode: 365
+        defaultMode: 0555
 {{- end }}

helm-toolkit/templates/manifests/_job-bootstrap.tpl

@@ -103,11 +103,11 @@ spec:
 {{- if $secretBin }}
           secret:
             secretName: {{ $secretBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- else }}
           configMap:
             name: {{ $configMapBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}
         - name: etc-service
           emptyDir: {}

helm-toolkit/templates/manifests/_job-db-drop-mysql.tpl

@@ -118,11 +118,11 @@ spec:
 {{- if $secretBin }}
           secret:
             secretName: {{ $secretBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- else }}
           configMap:
             name: {{ $configMapBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}
 {{- $local := dict "configMapBinFirst" true -}}
 {{- range $key1, $dbToDrop := $dbsToDrop }}
@@ -134,7 +134,7 @@ spec:
         - name: db-drop-conf
           secret:
             secretName: {{ $configMapEtc | quote }}
-            defaultMode: 292
+            defaultMode: 0444
 {{- end -}}
 {{- end -}}
 {{- end -}}

helm-toolkit/templates/manifests/_job-db-init-mysql.tpl

@@ -117,11 +117,11 @@ spec:
 {{- if $secretBin }}
           secret:
             secretName: {{ $secretBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- else }}
           configMap:
             name: {{ $configMapBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}
 {{- $local := dict "configMapBinFirst" true -}}
 {{- range $key1, $dbToInit := $dbsToInit }}
@@ -133,7 +133,7 @@ spec:
         - name: db-init-conf
           secret:
             secretName: {{ $configMapEtc | quote }}
-            defaultMode: 292
+            defaultMode: 0444
 {{- end -}}
 {{- end -}}
 {{- end -}}

helm-toolkit/templates/manifests/_job-db-sync.tpl

@@ -97,18 +97,18 @@ spec:
 {{- if $secretBin }}
           secret:
             secretName: {{ $secretBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- else }}
           configMap:
             name: {{ $configMapBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}
         - name: etc-service
           emptyDir: {}
         - name: db-sync-conf
           secret:
             secretName: {{ $configMapEtc | quote }}
-            defaultMode: 292
+            defaultMode: 0444
 {{- if $podVols }}
 {{ $podVols | toYaml | indent 8 }}
 {{- end }}

helm-toolkit/templates/manifests/_job-ks-endpoints.tpl

@@ -94,11 +94,11 @@ spec:
 {{- if $secretBin }}
           secret:
             secretName: {{ $secretBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- else }}
           configMap:
             name: {{ $configMapBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}
 {{- dict "enabled" true "name" $tlsSecret | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
 {{- end }}

helm-toolkit/templates/manifests/_job-ks-service.tpl

@@ -88,11 +88,11 @@ spec:
 {{- if $secretBin }}
           secret:
             secretName: {{ $secretBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- else }}
           configMap:
             name: {{ $configMapBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}
 {{- dict "enabled" true "name" $tlsSecret | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
 {{- end }}

helm-toolkit/templates/manifests/_job-ks-user.yaml.tpl

@@ -94,11 +94,11 @@ spec:
 {{- if $secretBin }}
           secret:
             secretName: {{ $secretBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- else }}
           configMap:
             name: {{ $configMapBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}
 {{- dict "enabled" true "name" $tlsSecret | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
 {{- end -}}

helm-toolkit/templates/manifests/_job-rabbit-init.yaml.tpl

@@ -86,10 +86,10 @@ spec:
 {{- if $secretBin }}
           secret:
             secretName: {{ $secretBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- else }}
           configMap:
             name: {{ $configMapBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}
 {{- end -}}

helm-toolkit/templates/manifests/_job-s3-bucket.yaml.tpl

@@ -103,18 +103,18 @@ spec:
 {{- if $secretBin }}
           secret:
             secretName: {{ $secretBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- else }}
           configMap:
             name: {{ $configMapBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}
         - name: etcceph
           emptyDir: {}
         - name: ceph-etc
           configMap:
             name: {{ $configMapCeph | quote }}
-            defaultMode: 292
+            defaultMode: 0444
         {{- if empty $envAll.Values.conf.ceph.admin_keyring }}
         - name: ceph-keyring
           secret:

helm-toolkit/templates/manifests/_job-s3-user.yaml.tpl

@@ -118,22 +118,22 @@ spec:
 {{- if $secretBin }}
           secret:
             secretName: {{ $secretBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- else }}
           configMap:
             name: {{ $configMapBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}
         - name: ceph-keyring-sh
           configMap:
             name: {{ $configMapBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
         - name: etcceph
           emptyDir: {}
         - name: ceph-etc
           configMap:
             name: {{ $configMapCeph | quote }}
-            defaultMode: 292
+            defaultMode: 0444
         {{- if empty $envAll.Values.conf.ceph.admin_keyring }}
         - name: ceph-keyring
           secret:

helm-toolkit/templates/manifests/_job_image_repo_sync.tpl

@@ -84,11 +84,11 @@ spec:
 {{- if $secretBin }}
           secret:
             secretName: {{ $secretBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- else }}
           configMap:
             name: {{ $configMapBin | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}
         - name: docker-socket
           hostPath:

ingress/templates/deployment-ingress.yaml

@@ -358,7 +358,7 @@ spec:
         - name: ingress-bin
           configMap:
             name: ingress-bin
-            defaultMode: 365
+            defaultMode: 0555
       {{- if and .Values.network.host_namespace .Values.network.vip.manage }}
         - name: host-rootfs
           hostPath:

kafka/templates/job-generate-acl.yaml

@@ -64,9 +64,9 @@ spec:
         - name: kafka-bin
           configMap:
             name: kafka-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: kafka-etc
           secret:
             secretName: kafka-etc
-            defaultMode: 292
+            defaultMode: 0444
 {{- end }}

kafka/templates/pod-helm-test.yaml

@@ -66,9 +66,9 @@ spec:
     - name: kafka-bin
       configMap:
         name: kafka-bin
-        defaultMode: 365
+        defaultMode: 0555
     - name: kafka-etc
       secret:
         secretName: kafka-etc
-        defaultMode: 292
+        defaultMode: 0444
 {{- end }}

kafka/templates/statefulset.yaml

@@ -168,11 +168,11 @@ spec:
         - name: kafka-bin
           configMap:
             name: kafka-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: kafka-etc
           secret:
             secretName: kafka-etc
-            defaultMode: 292
+            defaultMode: 0444
 {{ if $mounts_kafka.volumes }}{{ toYaml $mounts_kafka.volumes | indent 8 }}{{ end }}
 {{- if not .Values.storage.enabled }}
         - name: data

kibana/templates/deployment.yaml

@@ -167,9 +167,9 @@ spec:
         - name: kibana-bin
           configMap:
             name: kibana-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: kibana-etc
           secret:
             secretName: kibana-etc
-            defaultMode: 292
+            defaultMode: 0444
 {{- end }}

kibana/templates/job-flush-kibana-metadata.yaml

@@ -96,5 +96,5 @@ spec:
         - name: kibana-bin
           configMap:
             name: kibana-bin
-            defaultMode: 493
+            defaultMode: 0755
 {{- end }}

kibana/templates/job-register-kibana-indexes.yaml

@@ -80,5 +80,5 @@ spec:
         - name: kibana-bin
           configMap:
             name: kibana-bin
-            defaultMode: 493
+            defaultMode: 0755
 {{- end }}

kubernetes-keystone-webhook/templates/deployment.yaml

@@ -83,13 +83,13 @@ spec:
         - name: key-kubernetes-keystone-webhook
           secret:
             secretName: {{ $envAll.Values.secrets.certificates.api }}
-            defaultMode: 292
+            defaultMode: 0444
         - name: kubernetes-keystone-webhook-etc
           configMap:
             name: kubernetes-keystone-webhook-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: kubernetes-keystone-webhook-bin
           configMap:
             name: kubernetes-keystone-webhook-bin
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

kubernetes-keystone-webhook/templates/pod-test.yaml

@@ -60,6 +60,6 @@ spec:
     - name: kubernetes-keystone-webhook-bin
       configMap:
         name: kubernetes-keystone-webhook-bin
-        defaultMode: 365
+        defaultMode: 0555
 {{ if $mounts_kubernetes_keystone_webhook_tests.volumes }}{{ toYaml $mounts_kubernetes_keystone_webhook_tests.volumes | indent 4 }}{{ end }}
 {{- end }}

libvirt/templates/daemonset-libvirt.yaml

@@ -207,11 +207,11 @@ spec:
         - name: libvirt-bin
           configMap:
             name: libvirt-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: libvirt-etc
           secret:
             secretName: {{ $configMapName }}
-            defaultMode: 292
+            defaultMode: 0444
         {{- if .Values.conf.ceph.enabled }}
         - name: etcceph
           hostPath:
@@ -219,7 +219,7 @@ spec:
         - name: ceph-etc
           configMap:
             name: {{ .Values.ceph_client.configmap }}
-            defaultMode: 292
+            defaultMode: 0444
         {{- if empty .Values.conf.ceph.cinder.keyring }}
         - name: ceph-keyring
           secret:

mariadb/templates/deployment-ingress.yaml

@@ -205,9 +205,9 @@ spec:
         - name: mariadb-bin
           configMap:
             name: mariadb-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: mariadb-ingress-etc
           configMap:
             name: mariadb-ingress-etc
-            defaultMode: 292
+            defaultMode: 0444
 {{- end }}

mariadb/templates/pod-test.yaml

@@ -67,9 +67,9 @@ spec:
     - name: mariadb-bin
       configMap:
         name: mariadb-bin
-        defaultMode: 365
+        defaultMode: 0555
     - name: mariadb-secrets
       secret:
         secretName: mariadb-secrets
-        defaultMode: 292
+        defaultMode: 0444
 {{- end }}

mariadb/templates/statefulset.yaml

@@ -239,15 +239,15 @@ spec:
         - name: mariadb-bin
           configMap:
             name: mariadb-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: mariadb-etc
           configMap:
             name: mariadb-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: mariadb-secrets
           secret:
             secretName: mariadb-secrets
-            defaultMode: 292
+            defaultMode: 0444
         {{- if not .Values.volume.enabled }}
         - name: mysql-data
         {{- if .Values.volume.use_local_path_for_single_pod_cluster.enabled }}

memcached/templates/deployment.yaml

@@ -86,6 +86,6 @@ spec:
         - name: memcached-bin
           configMap:
             name: {{ $configMapBinName | quote }}
-            defaultMode: 365
+            defaultMode: 0555
 {{ dict "envAll" $envAll "component" "memcached" "requireSys" true | include "helm-toolkit.snippets.kubernetes_apparmor_volumes" | indent 8 }}
 {{- end }}

mongodb/templates/statefulset.yaml

@@ -118,7 +118,7 @@ spec:
         - name: mongodb-bin
           configMap:
             name: mongodb-bin
-            defaultMode: 365
+            defaultMode: 0555
 {{- if not .Values.volume.enabled }}
         - name: mongodb-data
           hostPath:

nagios/templates/deployment.yaml

@@ -241,9 +241,9 @@ spec:
         - name: nagios-etc
           secret:
             secretName: nagios-etc
-            defaultMode: 292
+            defaultMode: 0444
         - name: nagios-bin
           configMap:
             name: nagios-bin
-            defaultMode: 365
+            defaultMode: 0555
 {{- end }}

nagios/templates/pod-helm-tests.yaml

@@ -75,5 +75,5 @@ spec:
     - name: nagios-bin
       configMap:
         name: nagios-bin
-        defaultMode: 365
+        defaultMode: 0555
 {{- end }}

openvswitch/templates/daemonset-ovs-db.yaml

@@ -108,7 +108,7 @@ spec:
         - name: openvswitch-bin
           configMap:
             name: openvswitch-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: run
           hostPath:
             path: /run/openvswitch

openvswitch/templates/daemonset-ovs-vswitchd.yaml

@@ -153,7 +153,7 @@ It should be handled through lcore and pmd core masks. */}}
         - name: openvswitch-bin
           configMap:
             name: openvswitch-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: run
           hostPath:
             path: /run

postgresql/templates/pod-test.yaml

@@ -72,6 +72,6 @@ spec:
     - name: postgresql-bin
       secret:
         secretName: postgresql-bin
-        defaultMode: 365
+        defaultMode: 0555
 ...
 {{- end }}

postgresql/templates/statefulset.yaml

@@ -416,7 +416,7 @@ spec:
         - name: postgresql-bin
           secret:
             secretName: postgresql-bin
-            defaultMode: 365
+            defaultMode: 0555
         - name: client-certs-temp
           emptyDir: {}
         - name: server-certs-temp
@@ -428,15 +428,15 @@ spec:
         - name: replication-pki
           secret:
             secretName: {{ .Values.secrets.postgresql.replica }}
-            defaultMode: 416
+            defaultMode: 0640
         - name: postgresql-pki
           secret:
             secretName: {{ .Values.secrets.postgresql.server }}
-            defaultMode: 416
+            defaultMode: 0640
         - name: postgresql-etc
           secret:
             secretName: postgresql-etc
-            defaultMode: 292
+            defaultMode: 0444
 {{- if not .Values.storage.pvc.enabled }}
         - name: postgresql-data
           hostPath: