Skip to content

Commit 7abd583

Browse files
tamalsahatamalsaha
committed
Make securityContext configurable for license-proxyserver-manager
Signed-off-by: Tamal Saha <tamal@appscode.com>
1 parent 00c3420 commit 7abd583

6 files changed

Lines changed: 118 additions & 28 deletions

File tree

‎apis/installer/v1alpha1/license_proxyserver_manager_types.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ limitations under the License.
1717
package v1alpha1
1818

1919
import (
20+
core "k8s.io/api/core/v1"
2021
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2122
)
2223

@@ -59,6 +60,8 @@ type LicenseProxyserverManagerSpec struct {
5960
Placement PlacementSpec `json:"placement"`
6061
Kubectl DockerImage `json:"kubectl"`
6162
Platform PlatformSpec `json:"platform"`
63+
//+optional
64+
SecurityContext *core.SecurityContext `json:"securityContext"`
6265
}
6366

6467
type PlacementSpec struct {

‎apis/installer/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 6 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/license-proxyserver-manager/README.md‎

Lines changed: 24 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -45,24 +45,30 @@ The command removes all the Kubernetes components associated with the chart and
4545

4646
The following table lists the configurable parameters of the `license-proxyserver-manager` chart and their default values.
4747

48-
| Parameter | Description | Default |
49-
|--------------------------------|---------------------------------------------------------------------|----------------------------------------------------------|
50-
| nameOverride | | <code>""</code> |
51-
| fullnameOverride | | <code>""</code> |
52-
| registryFQDN | Docker registry fqdn used to pull license-proxyserver docker images | <code>ghcr.io</code> |
53-
| image | | <code>ghcr.io/appscode/license-proxyserver</code> |
54-
| tag | | <code>""</code> |
55-
| imagePullPolicy | | <code>Always</code> |
56-
| kubeconfigSecretName | | <code>""</code> |
57-
| addonManagerNamespace | | <code>open-cluster-management-license-proxyserver</code> |
58-
| placement.create | | <code>true</code> |
59-
| placement.name | | <code>global</code> |
60-
| kubectl.image | | <code>ghcr.io/appscode/kubectl-nonroot:1.31</code> |
61-
| platform.baseURL | | <code>""</code> |
62-
| platform.token | | <code>""</code> |
63-
| platform.tokenSecretName | | <code>""</code> |
64-
| platform.caBundle | | <code>""</code> |
65-
| platform.insecureSkipTLSVerify | | <code>false</code> |
48+
| Parameter | Description | Default |
49+
|------------------------------------------|---------------------------------------------------------------------|----------------------------------------------------------|
50+
| nameOverride | | <code>""</code> |
51+
| fullnameOverride | | <code>""</code> |
52+
| registryFQDN | Docker registry fqdn used to pull license-proxyserver docker images | <code>ghcr.io</code> |
53+
| image | | <code>ghcr.io/appscode/license-proxyserver</code> |
54+
| tag | | <code>""</code> |
55+
| imagePullPolicy | | <code>Always</code> |
56+
| kubeconfigSecretName | | <code>""</code> |
57+
| addonManagerNamespace | | <code>open-cluster-management-license-proxyserver</code> |
58+
| placement.create | | <code>true</code> |
59+
| placement.name | | <code>global</code> |
60+
| kubectl.image | | <code>ghcr.io/appscode/kubectl-nonroot:1.31</code> |
61+
| platform.baseURL | | <code>""</code> |
62+
| platform.token | | <code>""</code> |
63+
| platform.tokenSecretName | | <code>""</code> |
64+
| platform.caBundle | | <code>""</code> |
65+
| platform.insecureSkipTLSVerify | | <code>false</code> |
66+
| securityContext.allowPrivilegeEscalation | | <code>false</code> |
67+
| securityContext.privileged | | <code>false</code> |
68+
| securityContext.runAsNonRoot | | <code>true</code> |
69+
| securityContext.runAsUser | | <code>65534</code> |
70+
| securityContext.readOnlyRootFilesystem | | <code>true</code> |
71+
| securityContext.seccompProfile.type | | <code>RuntimeDefault</code> |
6672

6773

6874
Specify each parameter using the `--set key=value[,key=value]` argument to `helm upgrade -i`. For example:

‎charts/license-proxyserver-manager/templates/deployment.yaml‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -51,15 +51,7 @@ spec:
5151
- name: NAMESPACE
5252
value: {{ include "license-proxyserver-manager.namespace" . }}
5353
securityContext:
54-
allowPrivilegeEscalation: false
55-
capabilities:
56-
drop:
57-
- ALL
58-
privileged: false
59-
runAsNonRoot: true
60-
readOnlyRootFilesystem: true
61-
seccompProfile:
62-
type: RuntimeDefault
54+
{{- toYaml .Values.securityContext | nindent 12 }}
6355
volumeMounts:
6456
- mountPath: /tmp
6557
name: cache-dir

‎charts/license-proxyserver-manager/values.openapiv3_schema.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,78 @@ properties:
4545
type: object
4646
registryFQDN:
4747
type: string
48+
securityContext:
49+
properties:
50+
allowPrivilegeEscalation:
51+
type: boolean
52+
appArmorProfile:
53+
properties:
54+
localhostProfile:
55+
type: string
56+
type:
57+
type: string
58+
required:
59+
- type
60+
type: object
61+
capabilities:
62+
properties:
63+
add:
64+
items:
65+
type: string
66+
type: array
67+
x-kubernetes-list-type: atomic
68+
drop:
69+
items:
70+
type: string
71+
type: array
72+
x-kubernetes-list-type: atomic
73+
type: object
74+
privileged:
75+
type: boolean
76+
procMount:
77+
type: string
78+
readOnlyRootFilesystem:
79+
type: boolean
80+
runAsGroup:
81+
format: int64
82+
type: integer
83+
runAsNonRoot:
84+
type: boolean
85+
runAsUser:
86+
format: int64
87+
type: integer
88+
seLinuxOptions:
89+
properties:
90+
level:
91+
type: string
92+
role:
93+
type: string
94+
type:
95+
type: string
96+
user:
97+
type: string
98+
type: object
99+
seccompProfile:
100+
properties:
101+
localhostProfile:
102+
type: string
103+
type:
104+
type: string
105+
required:
106+
- type
107+
type: object
108+
windowsOptions:
109+
properties:
110+
gmsaCredentialSpec:
111+
type: string
112+
gmsaCredentialSpecName:
113+
type: string
114+
hostProcess:
115+
type: boolean
116+
runAsUserName:
117+
type: string
118+
type: object
119+
type: object
48120
tag:
49121
type: string
50122
required:

‎charts/license-proxyserver-manager/values.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,15 @@ platform:
2424
tokenSecretName: ""
2525
caBundle: ""
2626
insecureSkipTLSVerify: false
27+
28+
securityContext:
29+
allowPrivilegeEscalation: false
30+
capabilities:
31+
drop:
32+
- ALL
33+
privileged: false
34+
runAsNonRoot: true
35+
runAsUser: 65534
36+
readOnlyRootFilesystem: true
37+
seccompProfile:
38+
type: RuntimeDefault

0 commit comments

Comments
 (0)