From 451e4f636b1146b9cc048f1f14f365a586037523 Mon Sep 17 00:00:00 2001 From: d3adb5 Date: Sun, 5 Feb 2023 20:51:03 -0800 Subject: [PATCH 1/2] feat: set read-only root filesystem at container level Change the securityContext field of the Reloader container if reloader.readOnlyFilesystem is set to true. The change takes effect even if not container securityContext is defined. Closes #339. --- .../chart/reloader/templates/deployment.yaml | 10 ++-- .../chart/reloader/tests/deployment_test.yaml | 50 +++++++++++++++++++ 2 files changed, 57 insertions(+), 3 deletions(-) create mode 100644 deployments/kubernetes/chart/reloader/tests/deployment_test.yaml diff --git a/deployments/kubernetes/chart/reloader/templates/deployment.yaml b/deployments/kubernetes/chart/reloader/templates/deployment.yaml index 3f99c8d9..2e6546a3 100644 --- a/deployments/kubernetes/chart/reloader/templates/deployment.yaml +++ b/deployments/kubernetes/chart/reloader/templates/deployment.yaml @@ -148,9 +148,13 @@ spec: periodSeconds: {{ .Values.reloader.deployment.readinessProbe.periodSeconds | default "10" }} successThreshold: {{ .Values.reloader.deployment.readinessProbe.successThreshold | default "1" }} - {{- with .Values.reloader.deployment.containerSecurityContext }} - securityContext: {{ toYaml . | nindent 10 }} - {{- end }} + {{- $containerSecurityContext := .Values.reloader.deployment.containerSecurityContext | default dict }} + {{- if .Values.reloader.readOnlyRootFilesystem }} + {{- $_ := set $containerSecurityContext "readOnlyRootFilesystem" true }} + {{- end }} + + securityContext: + {{- toYaml $containerSecurityContext | nindent 10 }} {{- if eq .Values.reloader.readOnlyRootFileSystem true }} volumeMounts: diff --git a/deployments/kubernetes/chart/reloader/tests/deployment_test.yaml b/deployments/kubernetes/chart/reloader/tests/deployment_test.yaml new file mode 100644 index 00000000..ef6c6e47 --- /dev/null +++ b/deployments/kubernetes/chart/reloader/tests/deployment_test.yaml @@ -0,0 +1,50 @@ +suite: Deployment + +templates: + - deployment.yaml + +tests: + - it: sets readOnlyRootFilesystem in container securityContext when reloader.readOnlyRootFilesystem is true + set: + reloader: + readOnlyRootFilesystem: true + deployment: + containerSecurityContext: + readOnlyRootFilesystem: false + asserts: + - equal: + path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem + value: true + + - it: sets readOnlyRootFilesystem in container securityContext even if reloader.deployment.containerSecurityContext is null + set: + reloader: + readOnlyRootFilesystem: true + deployment: + containerSecurityContext: null + asserts: + - equal: + path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem + value: true + + - it: does not override readOnlyRootFilesystem in container securityContext based on reloader.readOnlyRootFilesystem + set: + reloader: + readOnlyRootFilesystem: false + deployment: + containerSecurityContext: + readOnlyRootFilesystem: true + asserts: + - equal: + path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem + value: true + + - it: template is still valid with no defined containerSecurityContext + set: + reloader: + readOnlyRootFilesystem: false + deployment: + containerSecurityContext: null + asserts: + - isEmpty: + path: spec.template.spec.containers[0].securityContext From 5a9ccbf01f59d1657becaa5843d12bcd53e08ce6 Mon Sep 17 00:00:00 2001 From: d3adb5 Date: Wed, 8 Feb 2023 14:15:28 -0800 Subject: [PATCH 2/2] fix: properly capitalize 'filesystem' in values Use the proper capitalization in the reference to the value reloader.readOnlyRootFileSystem: FileSystem instead of Filesystem. --- .../chart/reloader/templates/deployment.yaml | 2 +- .../chart/reloader/tests/deployment_test.yaml | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/deployments/kubernetes/chart/reloader/templates/deployment.yaml b/deployments/kubernetes/chart/reloader/templates/deployment.yaml index 2e6546a3..6b312b15 100644 --- a/deployments/kubernetes/chart/reloader/templates/deployment.yaml +++ b/deployments/kubernetes/chart/reloader/templates/deployment.yaml @@ -149,7 +149,7 @@ spec: successThreshold: {{ .Values.reloader.deployment.readinessProbe.successThreshold | default "1" }} {{- $containerSecurityContext := .Values.reloader.deployment.containerSecurityContext | default dict }} - {{- if .Values.reloader.readOnlyRootFilesystem }} + {{- if .Values.reloader.readOnlyRootFileSystem }} {{- $_ := set $containerSecurityContext "readOnlyRootFilesystem" true }} {{- end }} diff --git a/deployments/kubernetes/chart/reloader/tests/deployment_test.yaml b/deployments/kubernetes/chart/reloader/tests/deployment_test.yaml index ef6c6e47..7fabe5c4 100644 --- a/deployments/kubernetes/chart/reloader/tests/deployment_test.yaml +++ b/deployments/kubernetes/chart/reloader/tests/deployment_test.yaml @@ -4,10 +4,10 @@ templates: - deployment.yaml tests: - - it: sets readOnlyRootFilesystem in container securityContext when reloader.readOnlyRootFilesystem is true + - it: sets readOnlyRootFilesystem in container securityContext when reloader.readOnlyRootFileSystem is true set: reloader: - readOnlyRootFilesystem: true + readOnlyRootFileSystem: true deployment: containerSecurityContext: readOnlyRootFilesystem: false @@ -19,7 +19,7 @@ tests: - it: sets readOnlyRootFilesystem in container securityContext even if reloader.deployment.containerSecurityContext is null set: reloader: - readOnlyRootFilesystem: true + readOnlyRootFileSystem: true deployment: containerSecurityContext: null asserts: @@ -27,10 +27,10 @@ tests: path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem value: true - - it: does not override readOnlyRootFilesystem in container securityContext based on reloader.readOnlyRootFilesystem + - it: does not override readOnlyRootFilesystem in container securityContext based on reloader.readOnlyRootFileSystem set: reloader: - readOnlyRootFilesystem: false + readOnlyRootFileSystem: false deployment: containerSecurityContext: readOnlyRootFilesystem: true @@ -42,7 +42,7 @@ tests: - it: template is still valid with no defined containerSecurityContext set: reloader: - readOnlyRootFilesystem: false + readOnlyRootFileSystem: false deployment: containerSecurityContext: null asserts: