Skip to content

Commit 70cbc9e

Browse files
olamilekan000olamilekan000
committed
add security context to container spec
1 parent 9130003 commit 70cbc9e

10 files changed

Lines changed: 363 additions & 5 deletions

File tree

‎charts/ingest/templates/deployment.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,10 @@ spec:
4040
- name: {{ .Chart.Name }}
4141
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
4242
imagePullPolicy: {{ .Values.image.pullPolicy }}
43+
{{- if .Values.containerSecurityContext }}
44+
securityContext:
45+
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
46+
{{- end }}
4347
command: ["/cmd"]
4448
args: ["ingest", "--interval", "60"]
4549
ports:

‎charts/ingest/values.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,61 @@
22
# This is a YAML-formatted file.
33
# Declare variables to be passed into your templates.
44

5+
global:
6+
externalDatabase:
7+
# -- Enable an external database, This will use postgresql chart, Change values if you use an external database
8+
enabled: true
9+
# -- Host for the external database
10+
host: "postgresql"
11+
# -- Password for the external database
12+
postgresPassword: &postgresPassword "postgres"
13+
# -- Database name for the external database
14+
database: &postgresDatabase "convoy"
15+
# -- Password for the external database, ignored in case of secret parameter with non-empty value
16+
password: &userPassword "postgres"
17+
# -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
18+
secret: ""
19+
# -- Username for the external database
20+
username: &username "postgres"
21+
# -- Scheme for the external database. This is postgres by default
22+
scheme: "postgres"
23+
# -- Query params for the external database
24+
options: "sslmode=disable&connect_timeout=30"
25+
# -- Port for the external database
26+
port: 5432
27+
28+
nativeRedis:
29+
# -- Enable redis, This will use redis chart, Disable if you use an external redis
30+
enabled: &redisEnabled true
31+
# -- Host for the redis
32+
host: "redis-master"
33+
# -- password for the redis, ignored in case of secret parameter with non-empty value
34+
password: &redisPassword "convoy"
35+
# -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
36+
secret: ""
37+
# -- Port for the redis
38+
port: 6379
39+
40+
externalRedis:
41+
# -- Enable external redis, Enable this if you use an external redis and disable Native redis
42+
enabled: false
43+
# -- redis cluster addresses, if set the other values won't be used
44+
addresses: ""
45+
# -- Host for the external redis
46+
host: ""
47+
# -- Scheme for the external redis. This can be redis, rediss, redis-socket or redis-sentinel
48+
scheme: ""
49+
# -- username for the external redis.
50+
username: ""
51+
# -- password for the external redis, ignored in case of secret parameter with non-empty value
52+
password: ""
53+
# -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
54+
secret: ""
55+
# -- Database name for the external redis.
56+
database: ""
57+
# -- Port for the external redis
58+
port: ""
59+
560
enabled: true
661
app:
762
replicaCount: 1
@@ -57,3 +112,16 @@ podDisruptionBudget: {}
57112
nodeSelector: {}
58113
tolerations: []
59114
affinity: {}
115+
116+
# containerSecurityContext holds container level security attributes.
117+
containerSecurityContext:
118+
runAsNonRoot: true
119+
runAsUser: 1000
120+
allowPrivilegeEscalation: false
121+
privileged: false
122+
readOnlyRootFilesystem: true
123+
seccompProfile:
124+
type: RuntimeDefault
125+
capabilities:
126+
drop:
127+
- ALL

‎charts/migrate/templates/job.yaml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,10 @@ kind: Job
33
metadata:
44
name: {{ include "convoy-migrate.fullname" . }}
55
annotations:
6-
{{- toYaml .Values.jobAnnotations | nindent 4 }}
6+
{{- if .Values.jobAnnotations }}
7+
annotations:
8+
{{- toYaml .Values.jobAnnotations | nindent 4 }}
9+
{{- end }}
710
"helm.sh/hook": post-install,post-upgrade
811
"helm.sh/hook-weight": "0"
912
"helm.sh/hook-delete-policy": before-hook-creation
@@ -21,6 +24,10 @@ spec:
2124
- name: {{ .Chart.Name }}
2225
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
2326
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
27+
{{- if .Values.containerSecurityContext }}
28+
securityContext:
29+
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
30+
{{- end }}
2431
command: ["/cmd"]
2532
args: ["migrate", "up"]
2633
env:

‎charts/migrate/values.yaml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,60 @@
11
# Default values for convoy-migrate.
22
# This is a YAML-formatted file.
33
# Declare variables to be passed into your templates.
4+
global:
5+
externalDatabase:
6+
# -- Enable an external database, This will use postgresql chart, Change values if you use an external database
7+
enabled: true
8+
# -- Host for the external database
9+
host: "postgresql"
10+
# -- Password for the external database
11+
postgresPassword: &postgresPassword "postgres"
12+
# -- Database name for the external database
13+
database: &postgresDatabase "convoy"
14+
# -- Password for the external database, ignored in case of secret parameter with non-empty value
15+
password: &userPassword "postgres"
16+
# -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
17+
secret: ""
18+
# -- Username for the external database
19+
username: &username "postgres"
20+
# -- Scheme for the external database. This is postgres by default
21+
scheme: "postgres"
22+
# -- Query params for the external database
23+
options: "sslmode=disable&connect_timeout=30"
24+
# -- Port for the external database
25+
port: 5432
26+
27+
nativeRedis:
28+
# -- Enable redis, This will use redis chart, Disable if you use an external redis
29+
enabled: &redisEnabled true
30+
# -- Host for the redis
31+
host: "redis-master"
32+
# -- password for the redis, ignored in case of secret parameter with non-empty value
33+
password: &redisPassword "convoy"
34+
# -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
35+
secret: ""
36+
# -- Port for the redis
37+
port: 6379
38+
39+
externalRedis:
40+
# -- Enable external redis, Enable this if you use an external redis and disable Native redis
41+
enabled: false
42+
# -- redis cluster addresses, if set the other values won't be used
43+
addresses: ""
44+
# -- Host for the external redis
45+
host: ""
46+
# -- Scheme for the external redis. This can be redis, rediss, redis-socket or redis-sentinel
47+
scheme: ""
48+
# -- username for the external redis.
49+
username: ""
50+
# -- password for the external redis, ignored in case of secret parameter with non-empty value
51+
password: ""
52+
# -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
53+
secret: ""
54+
# -- Database name for the external redis.
55+
database: ""
56+
# -- Port for the external redis
57+
port: ""
458

559
app:
660
replicaCount: 1
@@ -29,3 +83,16 @@ tolerations: []
2983
affinity: {}
3084

3185
jobAnnotations: {}
86+
87+
# containerSecurityContext holds container level security attributes.
88+
containerSecurityContext:
89+
runAsNonRoot: true
90+
runAsUser: 1000
91+
allowPrivilegeEscalation: false
92+
privileged: false
93+
readOnlyRootFilesystem: true
94+
seccompProfile:
95+
type: RuntimeDefault
96+
capabilities:
97+
drop:
98+
- ALL

‎charts/server/templates/deployment.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,10 @@ spec:
4040
- name: {{ .Chart.Name }}
4141
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
4242
imagePullPolicy: {{ .Values.image.pullPolicy }}
43-
43+
{{- if .Values.containerSecurityContext }}
44+
securityContext:
45+
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
46+
{{- end }}
4447
command: ["/cmd"]
4548
args: ["server"]
4649
ports:

‎charts/server/values.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,61 @@
22
# This is a YAML-formatted file.
33
# Declare variables to be passed into your templates.
44

5+
global:
6+
externalDatabase:
7+
# -- Enable an external database, This will use postgresql chart, Change values if you use an external database
8+
enabled: true
9+
# -- Host for the external database
10+
host: "postgresql"
11+
# -- Password for the external database
12+
postgresPassword: &postgresPassword "postgres"
13+
# -- Database name for the external database
14+
database: &postgresDatabase "convoy"
15+
# -- Password for the external database, ignored in case of secret parameter with non-empty value
16+
password: &userPassword "postgres"
17+
# -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
18+
secret: ""
19+
# -- Username for the external database
20+
username: &username "postgres"
21+
# -- Scheme for the external database. This is postgres by default
22+
scheme: "postgres"
23+
# -- Query params for the external database
24+
options: "sslmode=disable&connect_timeout=30"
25+
# -- Port for the external database
26+
port: 5432
27+
28+
nativeRedis:
29+
# -- Enable redis, This will use redis chart, Disable if you use an external redis
30+
enabled: &redisEnabled true
31+
# -- Host for the redis
32+
host: "redis-master"
33+
# -- password for the redis, ignored in case of secret parameter with non-empty value
34+
password: &redisPassword "convoy"
35+
# -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
36+
secret: ""
37+
# -- Port for the redis
38+
port: 6379
39+
40+
externalRedis:
41+
# -- Enable external redis, Enable this if you use an external redis and disable Native redis
42+
enabled: false
43+
# -- redis cluster addresses, if set the other values won't be used
44+
addresses: ""
45+
# -- Host for the external redis
46+
host: ""
47+
# -- Scheme for the external redis. This can be redis, rediss, redis-socket or redis-sentinel
48+
scheme: ""
49+
# -- username for the external redis.
50+
username: ""
51+
# -- password for the external redis, ignored in case of secret parameter with non-empty value
52+
password: ""
53+
# -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
54+
secret: ""
55+
# -- Database name for the external redis.
56+
database: ""
57+
# -- Port for the external redis
58+
port: ""
59+
560
app:
661
replicaCount: 1
762
port: 5005
@@ -90,3 +145,16 @@ podDisruptionBudget: {}
90145
nodeSelector: {}
91146
tolerations: []
92147
affinity: {}
148+
149+
# containerSecurityContext holds container level security attributes.
150+
containerSecurityContext:
151+
runAsNonRoot: true
152+
runAsUser: 1000
153+
allowPrivilegeEscalation: false
154+
privileged: false
155+
readOnlyRootFilesystem: true
156+
seccompProfile:
157+
type: RuntimeDefault
158+
capabilities:
159+
drop:
160+
- ALL

‎charts/stream/templates/deployment.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,10 @@ spec:
4141
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
4242
imagePullPolicy: {{ .Values.image.pullPolicy }}
4343
command: ["/cmd"]
44+
{{- if .Values.containerSecurityContext }}
45+
securityContext:
46+
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
47+
{{- end }}
4448
args: ["stream"]
4549
ports:
4650
- name: http

‎charts/stream/values.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,61 @@
22
# This is a YAML-formatted file.
33
# Declare variables to be passed into your templates.
44

5+
global:
6+
externalDatabase:
7+
# -- Enable an external database, This will use postgresql chart, Change values if you use an external database
8+
enabled: true
9+
# -- Host for the external database
10+
host: "postgresql"
11+
# -- Password for the external database
12+
postgresPassword: &postgresPassword "postgres"
13+
# -- Database name for the external database
14+
database: &postgresDatabase "convoy"
15+
# -- Password for the external database, ignored in case of secret parameter with non-empty value
16+
password: &userPassword "postgres"
17+
# -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
18+
secret: ""
19+
# -- Username for the external database
20+
username: &username "postgres"
21+
# -- Scheme for the external database. This is postgres by default
22+
scheme: "postgres"
23+
# -- Query params for the external database
24+
options: "sslmode=disable&connect_timeout=30"
25+
# -- Port for the external database
26+
port: 5432
27+
28+
nativeRedis:
29+
# -- Enable redis, This will use redis chart, Disable if you use an external redis
30+
enabled: &redisEnabled true
31+
# -- Host for the redis
32+
host: "redis-master"
33+
# -- password for the redis, ignored in case of secret parameter with non-empty value
34+
password: &redisPassword "convoy"
35+
# -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
36+
secret: ""
37+
# -- Port for the redis
38+
port: 6379
39+
40+
externalRedis:
41+
# -- Enable external redis, Enable this if you use an external redis and disable Native redis
42+
enabled: false
43+
# -- redis cluster addresses, if set the other values won't be used
44+
addresses: ""
45+
# -- Host for the external redis
46+
host: ""
47+
# -- Scheme for the external redis. This can be redis, rediss, redis-socket or redis-sentinel
48+
scheme: ""
49+
# -- username for the external redis.
50+
username: ""
51+
# -- password for the external redis, ignored in case of secret parameter with non-empty value
52+
password: ""
53+
# -- If this secret parameter is not empty, password value will be ignored. The password in the secret should be in the 'password' key
54+
secret: ""
55+
# -- Database name for the external redis.
56+
database: ""
57+
# -- Port for the external redis
58+
port: ""
59+
560
enabled: true
661
app:
762
replicaCount: 1
@@ -58,3 +113,16 @@ ingress:
58113
nodeSelector: {}
59114
tolerations: []
60115
affinity: {}
116+
117+
# containerSecurityContext holds container level security attributes.
118+
containerSecurityContext:
119+
runAsNonRoot: true
120+
runAsUser: 1000
121+
allowPrivilegeEscalation: false
122+
privileged: false
123+
readOnlyRootFilesystem: true
124+
seccompProfile:
125+
type: RuntimeDefault
126+
capabilities:
127+
drop:
128+
- ALL

‎charts/worker/templates/deployment.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,12 +41,15 @@ spec:
4141
imagePullPolicy: {{ .Values.image.pullPolicy }}
4242
command: ["/cmd"]
4343
args: ["worker"]
44+
{{- if .Values.containerSecurityContext }}
45+
securityContext:
46+
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
47+
{{- end }}
4448
ports:
4549
- name: http
4650
containerPort: {{ .Values.app.port }}
4751
protocol: TCP
4852
env:
49-
5053
- name: SERVICE_NAME
5154
value: {{ .Chart.Name }}
5255
- name: PORT
@@ -59,8 +62,6 @@ spec:
5962
value: {{ .Values.env.environment | quote }}
6063
- name: CONVOY_SIGNUP_ENABLED
6164
value: {{ .Values.env.sign_up_enabled | quote }}
62-
63-
6465
{{- if .Values.global.externalDatabase.enabled }}
6566
- name: CONVOY_DB_SCHEME
6667
value: {{ .Values.global.externalDatabase.scheme | quote }}

0 commit comments

Comments
 (0)