github/Reloader
1
0
Fork 0
mirror of https://github.com/stakater/Reloader.git synced 2026-08-27 14:37:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #386 from d3adb5/feat/set-rootfs-ro

Browse Source 
feat: set read-only root filesystem at container level
This commit is contained in:
Faizan Ahmad
2023-02-26 12:16:42 +01:00
committed by GitHub
parent 70aef8a871 5a9ccbf01f
commit c7f507a4b9
2 changed files with 57 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deployments/kubernetes/chart/reloader/templates/deployment.yaml
+7 -3
View File
@@ -146,9 +146,13 @@ spec:
periodSeconds: {{ .Values.reloader.deployment.readinessProbe.periodSeconds | default "10" }}
successThreshold: {{ .Values.reloader.deployment.readinessProbe.successThreshold | default "1" }}
{{- with .Values.reloader.deployment.containerSecurityContext }}
securityContext: {{ toYaml . | nindent 10 }}
{{- end }}
{{- $containerSecurityContext := .Values.reloader.deployment.containerSecurityContext | default dict }}
{{- if .Values.reloader.readOnlyRootFileSystem }}
{{- $_ := set $containerSecurityContext "readOnlyRootFilesystem" true }}
{{- end }}
securityContext:
{{- toYaml $containerSecurityContext | nindent 10 }}
{{- if eq .Values.reloader.readOnlyRootFileSystem true }}
volumeMounts:
deployments/kubernetes/chart/reloader/tests/deployment_test.yaml
+50
View File
@@ -0,0 +1,50 @@
suite: Deployment
templates:
- deployment.yaml
tests:
- it: sets readOnlyRootFilesystem in container securityContext when reloader.readOnlyRootFileSystem is true
set:
reloader:
readOnlyRootFileSystem: true
deployment:
containerSecurityContext:
readOnlyRootFilesystem: false
asserts:
- equal:
path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
value: true
- it: sets readOnlyRootFilesystem in container securityContext even if reloader.deployment.containerSecurityContext is null
set:
reloader:
readOnlyRootFileSystem: true
deployment:
containerSecurityContext: null
asserts:
- equal:
path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
value: true
- it: does not override readOnlyRootFilesystem in container securityContext based on reloader.readOnlyRootFileSystem
set:
reloader:
readOnlyRootFileSystem: false
deployment:
containerSecurityContext:
readOnlyRootFilesystem: true
asserts:
- equal:
path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
value: true
- it: template is still valid with no defined containerSecurityContext
set:
reloader:
readOnlyRootFileSystem: false
deployment:
containerSecurityContext: null
asserts:
- isEmpty:
path: spec.template.spec.containers[0].securityContext