Merge branch 'master' into add-fullname-override-on-values

2026-03-05 19:00:28 +00:00 · 2023-02-26 22:45:11 +09:00
parent ad03e5830d 032c391cb8
commit d660f9dbdf
23 changed files with 115 additions and 85 deletions
--- a/deployments/kubernetes/chart/reloader/Chart.yaml
+++ b/deployments/kubernetes/chart/reloader/Chart.yaml
@@ -3,8 +3,8 @@
 apiVersion: v1
 name: reloader
 description: Reloader chart that runs on kubernetes
-version: v1.0.5
-appVersion: v1.0.5
+version: v1.0.9
+appVersion: v1.0.9
 keywords:
  - Reloader
  - kubernetes
--- a/deployments/kubernetes/chart/reloader/templates/clusterrole.yaml
+++ b/deployments/kubernetes/chart/reloader/templates/clusterrole.yaml
@@ -38,8 +38,8 @@ rules:
    resources:
      - namespaces
    verbs:
-      - get         
-{{- end }}      
+      - get
+{{- end }}
 {{- if and (.Capabilities.APIVersions.Has "apps.openshift.io/v1") (.Values.reloader.isOpenshift) }}
  - apiGroups:
      - "apps.openshift.io"
--- a/deployments/kubernetes/chart/reloader/templates/deployment.yaml
+++ b/deployments/kubernetes/chart/reloader/templates/deployment.yaml
@@ -128,8 +128,6 @@ spec:

        ports:
        - name: http
-          containerPort: 9091
-        - name: metrics
          containerPort: 9090
        livenessProbe:
          httpGet:
@@ -142,15 +140,19 @@ spec:
        readinessProbe:
          httpGet:
            path: /metrics
-            port: metrics
+            port: http
          timeoutSeconds: {{ .Values.reloader.deployment.readinessProbe.timeoutSeconds | default "5" }}
          failureThreshold: {{ .Values.reloader.deployment.readinessProbe.failureThreshold | default "5" }}
          periodSeconds: {{ .Values.reloader.deployment.readinessProbe.periodSeconds | default "10" }}
          successThreshold: {{ .Values.reloader.deployment.readinessProbe.successThreshold | default "1" }}

-      {{- with .Values.reloader.deployment.containerSecurityContext }}
-        securityContext: {{ toYaml . | nindent 10 }}
-      {{- end }}
+        {{- $containerSecurityContext := .Values.reloader.deployment.containerSecurityContext | default dict }}
+        {{- if .Values.reloader.readOnlyRootFileSystem }}
+          {{- $_ := set $containerSecurityContext "readOnlyRootFilesystem" true }}
+        {{- end }}
+
+        securityContext:
+          {{- toYaml $containerSecurityContext | nindent 10 }}

      {{- if eq .Values.reloader.readOnlyRootFileSystem true }}
        volumeMounts:
--- a/deployments/kubernetes/chart/reloader/tests/deployment_test.yaml
+++ b/deployments/kubernetes/chart/reloader/tests/deployment_test.yaml
@@ -0,0 +1,50 @@
+suite: Deployment
+
+templates:
+  - deployment.yaml
+
+tests:
+  - it: sets readOnlyRootFilesystem in container securityContext when reloader.readOnlyRootFileSystem is true
+    set:
+      reloader:
+        readOnlyRootFileSystem: true
+        deployment:
+          containerSecurityContext:
+            readOnlyRootFilesystem: false
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
+          value: true
+
+  - it: sets readOnlyRootFilesystem in container securityContext even if reloader.deployment.containerSecurityContext is null
+    set:
+      reloader:
+        readOnlyRootFileSystem: true
+        deployment:
+          containerSecurityContext: null
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
+          value: true
+
+  - it: does not override readOnlyRootFilesystem in container securityContext based on reloader.readOnlyRootFileSystem
+    set:
+      reloader:
+        readOnlyRootFileSystem: false
+        deployment:
+          containerSecurityContext:
+            readOnlyRootFilesystem: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
+          value: true
+
+  - it: template is still valid with no defined containerSecurityContext
+    set:
+      reloader:
+        readOnlyRootFileSystem: false
+        deployment:
+          containerSecurityContext: null
+    asserts:
+      - isEmpty:
+          path: spec.template.spec.containers[0].securityContext
--- a/deployments/kubernetes/chart/reloader/values.yaml
+++ b/deployments/kubernetes/chart/reloader/values.yaml
@@ -69,10 +69,10 @@ reloader:
    labels:
      provider: stakater
      group: com.stakater.platform
-      version: v1.0.5
+      version: v1.0.9
    image:
      name: stakater/reloader
-      tag: v1.0.5
+      tag: v1.0.9
      pullPolicy: IfNotPresent
    # Support for extra environment variables.
    env:
--- a/deployments/kubernetes/kustomization.yaml
+++ b/deployments/kubernetes/kustomization.yaml
@@ -4,7 +4,5 @@ kind: Kustomization
 resources:
  - manifests/clusterrole.yaml
  - manifests/clusterrolebinding.yaml
-  - manifests/role.yaml
-  - manifests/rolebinding.yaml
  - manifests/serviceaccount.yaml
-  - manifests/deployment.yaml
+  - manifests/deployment.yaml
--- a/deployments/kubernetes/manifests/clusterrole.yaml
+++ b/deployments/kubernetes/manifests/clusterrole.yaml
@@ -9,7 +9,7 @@ metadata:
    meta.helm.sh/release-name: "reloader"
  labels:
    app: reloader-reloader
-    chart: "reloader-v1.0.5"
+    chart: "reloader-v1.0.9"
    release: "reloader"
    heritage: "Helm"
    app.kubernetes.io/managed-by: "Helm"
--- a/deployments/kubernetes/manifests/clusterrolebinding.yaml
+++ b/deployments/kubernetes/manifests/clusterrolebinding.yaml
@@ -9,7 +9,7 @@ metadata:
    meta.helm.sh/release-name: "reloader"
  labels:
    app: reloader-reloader
-    chart: "reloader-v1.0.5"
+    chart: "reloader-v1.0.9"
    release: "reloader"
    heritage: "Helm"
    app.kubernetes.io/managed-by: "Helm"
--- a/deployments/kubernetes/manifests/deployment.yaml
+++ b/deployments/kubernetes/manifests/deployment.yaml
@@ -8,13 +8,13 @@ metadata:
    meta.helm.sh/release-name: "reloader"
  labels:
    app: reloader-reloader
-    chart: "reloader-v1.0.5"
+    chart: "reloader-v1.0.9"
    release: "reloader"
    heritage: "Helm"
    app.kubernetes.io/managed-by: "Helm"
    group: com.stakater.platform
    provider: stakater
-    version: v1.0.5
+    version: v1.0.9
  name: reloader-reloader
  namespace: default
 spec:
@@ -28,23 +28,21 @@ spec:
    metadata:
      labels:
        app: reloader-reloader
-        chart: "reloader-v1.0.5"
+        chart: "reloader-v1.0.9"
        release: "reloader"
        heritage: "Helm"
        app.kubernetes.io/managed-by: "Helm"
        group: com.stakater.platform
        provider: stakater
-        version: v1.0.5
+        version: v1.0.9
    spec:
      containers:
-      - image: "stakater/reloader:v1.0.5"
+      - image: "stakater/reloader:v1.0.9"
        imagePullPolicy: IfNotPresent
        name: reloader-reloader

        ports:
        - name: http
-          containerPort: 9091
-        - name: metrics
          containerPort: 9090
        livenessProbe:
          httpGet:
@@ -57,11 +55,14 @@ spec:
        readinessProbe:
          httpGet:
            path: /metrics
-            port: metrics
+            port: http
          timeoutSeconds: 5
          failureThreshold: 5
          periodSeconds: 10
          successThreshold: 1
+
+        securityContext:
+          {}
      securityContext: 
        runAsNonRoot: true
        runAsUser: 65534
--- a/deployments/kubernetes/manifests/podmonitor.yaml
+++ b/deployments/kubernetes/manifests/podmonitor.yaml
@@ -1,3 +0,0 @@
---
-# Source: reloader/templates/podmonitor.yaml
-
--- a/deployments/kubernetes/manifests/role.yaml
+++ b/deployments/kubernetes/manifests/role.yaml
@@ -1,4 +0,0 @@
---
-# Source: reloader/templates/role.yaml
-
-
--- a/deployments/kubernetes/manifests/rolebinding.yaml
+++ b/deployments/kubernetes/manifests/rolebinding.yaml
@@ -1,4 +0,0 @@
---
-# Source: reloader/templates/rolebinding.yaml
-
-
--- a/deployments/kubernetes/manifests/service.yaml
+++ b/deployments/kubernetes/manifests/service.yaml
@@ -1,4 +0,0 @@
---
-# Source: reloader/templates/service.yaml
-
-
--- a/deployments/kubernetes/manifests/serviceaccount.yaml
+++ b/deployments/kubernetes/manifests/serviceaccount.yaml
@@ -8,7 +8,7 @@ metadata:
    meta.helm.sh/release-name: "reloader"
  labels:
    app: reloader-reloader
-    chart: "reloader-v1.0.5"
+    chart: "reloader-v1.0.9"
    release: "reloader"
    heritage: "Helm"
    app.kubernetes.io/managed-by: "Helm"
--- a/deployments/kubernetes/manifests/servicemonitor.yaml
+++ b/deployments/kubernetes/manifests/servicemonitor.yaml
@@ -1,4 +0,0 @@
---
-# Source: reloader/templates/servicemonitor.yaml
-
-
--- a/deployments/kubernetes/reloader.yaml
+++ b/deployments/kubernetes/reloader.yaml
@@ -8,7 +8,7 @@ metadata:
    meta.helm.sh/release-name: "reloader"
  labels:
    app: reloader-reloader
-    chart: "reloader-v1.0.5"
+    chart: "reloader-v1.0.9"
    release: "reloader"
    heritage: "Helm"
    app.kubernetes.io/managed-by: "Helm"
@@ -25,7 +25,7 @@ metadata:
    meta.helm.sh/release-name: "reloader"
  labels:
    app: reloader-reloader
-    chart: "reloader-v1.0.5"
+    chart: "reloader-v1.0.9"
    release: "reloader"
    heritage: "Helm"
    app.kubernetes.io/managed-by: "Helm"
@@ -80,7 +80,7 @@ metadata:
    meta.helm.sh/release-name: "reloader"
  labels:
    app: reloader-reloader
-    chart: "reloader-v1.0.5"
+    chart: "reloader-v1.0.9"
    release: "reloader"
    heritage: "Helm"
    app.kubernetes.io/managed-by: "Helm"
@@ -104,13 +104,13 @@ metadata:
    meta.helm.sh/release-name: "reloader"
  labels:
    app: reloader-reloader
-    chart: "reloader-v1.0.5"
+    chart: "reloader-v1.0.9"
    release: "reloader"
    heritage: "Helm"
    app.kubernetes.io/managed-by: "Helm"
    group: com.stakater.platform
    provider: stakater
-    version: v1.0.5
+    version: v1.0.9
  name: reloader-reloader
  namespace: default
 spec:
@@ -124,23 +124,21 @@ spec:
    metadata:
      labels:
        app: reloader-reloader
-        chart: "reloader-v1.0.5"
+        chart: "reloader-v1.0.9"
        release: "reloader"
        heritage: "Helm"
        app.kubernetes.io/managed-by: "Helm"
        group: com.stakater.platform
        provider: stakater
-        version: v1.0.5
+        version: v1.0.9
    spec:
      containers:
-      - image: "stakater/reloader:v1.0.5"
+      - image: "stakater/reloader:v1.0.9"
        imagePullPolicy: IfNotPresent
        name: reloader-reloader

        ports:
        - name: http
-          containerPort: 9091
-        - name: metrics
          containerPort: 9090
        livenessProbe:
          httpGet:
@@ -153,11 +151,14 @@ spec:
        readinessProbe:
          httpGet:
            path: /metrics
-            port: metrics
+            port: http
          timeoutSeconds: 5
          failureThreshold: 5
          periodSeconds: 10
          successThreshold: 1
+
+        securityContext:
+          {}
      securityContext: 
        runAsNonRoot: true
        runAsUser: 65534