openstack/openstack-helm
Code Issues Proposed changes

Merge "Using htk for glance security policies"

Browse Source
This commit is contained in:
Zuul
2019-07-03 20:59:11 +00:00
committed by Gerrit Code Review
parent 38e3237da4 9d72b805d0
commit dc247b3856
2 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
glance/templates/deployment-api.yaml
View File

@@ -57,9 +57,8 @@ spec:
{{ tuple $envAll "api" $mounts_glance_api_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }} {{ tuple $envAll "api" $mounts_glance_api_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
- name: glance-perms - name: glance-perms
{{ tuple $envAll "glance_api" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll "glance_api" | include "helm-toolkit.snippets.image" | indent 10 }}
securityContext:
runAsUser: 0
{{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "glance" "container" "glance_perms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
command: command:
- chown - chown
- -R - -R
@@ -73,6 +72,7 @@ spec:
{{ if eq .Values.storage "rbd" }} {{ if eq .Values.storage "rbd" }}
- name: ceph-keyring-placement - name: ceph-keyring-placement
{{ tuple $envAll "glance_api" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll "glance_api" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ dict "envAll" $envAll "application" "glance" "container" "ceph_keyring_placement" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
env: env:
- name: RBD_STORE_USER - name: RBD_STORE_USER
value: {{ .Values.conf.glance.glance_store.rbd_store_user | quote }} value: {{ .Values.conf.glance.glance_store.rbd_store_user | quote }}

6
glance/values.yaml
View File

@@ -818,6 +818,12 @@ pod:
pod: pod:
runAsUser: 42424 runAsUser: 42424
container: container:
glance_perms:
readOnlyRootFilesystem: true
runAsUser: 0
ceph_keyring_placement:
readOnlyRootFilesystem: true
runAsUser: 0
glance_api: glance_api:
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
allowPrivilegeEscalation: false allowPrivilegeEscalation: false