openstack/openstack-helm
Code Issues Proposed changes

Implement missing security context template for deployment server

Browse Source 
This change adds security context template at pod/container level

Change-Id: I2180cdf934ce21bc5ae7148f2830d1a8683e82db
This commit is contained in:
PrateekDodda 2020-08-28 22:02:09 -05:00 committed by Prateek Dodda
parent 9c39f2e328
commit c57391366a
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
neutron/templates/deployment-ironic-agent.yaml
View File

@ -60,7 +60,7 @@ spec:
- name: neutron-ironic-agent - name: neutron-ironic-agent
{{ tuple $envAll "neutron_ironic_agent" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll "neutron_ironic_agent" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.ironic_agent | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.ironic_agent | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "neutron" "container" "neutron_ironic_agent" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} {{ dict "envAll" $envAll "application" "neutron_ironic_agent" "container" "neutron_ironic_agent" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
command: command:
- /tmp/neutron-ironic-agent.sh - /tmp/neutron-ironic-agent.sh
- start - start

7
neutron/values.yaml
View File

@ -520,6 +520,9 @@ pod:
neutron_server: neutron_server:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
neutron_rpc_server:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
neutron_sriov_agent: neutron_sriov_agent:
pod: pod:
runAsUser: 42424 runAsUser: 42424
@ -534,6 +537,10 @@ pod:
neutron_ironic_agent: neutron_ironic_agent:
pod: pod:
runAsUser: 42424 runAsUser: 42424
container:
neutron_ironic_agent:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
neutron_netns_cleanup_cron: neutron_netns_cleanup_cron:
pod: pod:
runAsUser: 42424 runAsUser: 42424