github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

[stable/memcached] Add security context to memcached chart (#15317)

Browse Source 
* Add security context to memcached chart

Signed-off-by: Joris Andrade <joris@frontapp.com>

* Remove typo

Signed-off-by: Joris Andrade <joris@frontapp.com>

* Address comments

Signed-off-by: Joris Andrade <joris@frontapp.com>
This commit is contained in:
Joris ANDRADE
2019-07-11 05:26:55 -07:00
committed by Kubernetes Prow Robot
parent 3c4cc8f0cb
commit 08591fe2ac
4 changed files with 42 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/memcached/Chart.yaml
+1 -1
View File
@@ -1,6 +1,6 @@
apiVersion: v1
name: memcached
version: 2.8.3
version: 2.9.0
appVersion: 1.5.12
description: Free & open source, high-performance, distributed memory object caching
system.
stable/memcached/README.md
+22 -19
View File
@@ -40,25 +40,28 @@ The command removes all the Kubernetes components associated with the chart and
The following table lists the configurable parameters of the Memcached chart and their default values.
| Parameter | Description | Default |
|---------------------------|---------------------------------|---------------------------------------------------------|
| `image` | The image to pull and run | A recent official memcached tag |
| `imagePullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` |
| `memcached.verbosity` | Verbosity level (v, vv, or vvv) | Un-set. |
| `memcached.maxItemMemory` | Max memory for items (in MB) | `64` |
| `memcached.extraArgs` | Additional memcached arguments | `[]` |
| `metrics.enabled` | Expose metrics in prometheus format | false |
| `metrics.image` | The image to pull and run for the metrics exporter | A recent official memcached tag |
| `metrics.imagePullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` |
| `metrics.resources` | CPU/Memory resource requests/limits for the metrics exporter | `{}` |
| `extraContainers` | Container sidecar definition(s) as string | Un-set |
| `extraVolumes` | Volume definitions to add as string | Un-set |
| `kind` | Install as StatefulSet or Deployment | StatefulSet |
| `podAnnotations` | Map of annotations to add to the pod(s) | `{}` |
| `podLabels` | Custom Labels to be applied to statefulset | Un-set |
| `nodeSelector` | Simple pod scheduling control | `{}` |
| `tolerations` | Allow or deny specific node taints | `{}` |
| `affinity` | Advanced pod scheduling control | `{}` |
| Parameter | Description | Default |
|----------------------------|---------------------------------|---------------------------------------------------------|
| `image` | The image to pull and run | A recent official memcached tag |
| `imagePullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` |
| `memcached.verbosity` | Verbosity level (v, vv, or vvv) | Un-set. |
| `memcached.maxItemMemory` | Max memory for items (in MB) | `64` |
| `memcached.extraArgs` | Additional memcached arguments | `[]` |
| `metrics.enabled` | Expose metrics in prometheus format | false |
| `metrics.image` | The image to pull and run for the metrics exporter | A recent official memcached tag |
| `metrics.imagePullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` |
| `metrics.resources` | CPU/Memory resource requests/limits for the metrics exporter | `{}` |
| `extraContainers` | Container sidecar definition(s) as string | Un-set |
| `extraVolumes` | Volume definitions to add as string | Un-set |
| `kind` | Install as StatefulSet or Deployment | StatefulSet |
| `podAnnotations` | Map of annotations to add to the pod(s) | `{}` |
| `podLabels` | Custom Labels to be applied to statefulset | Un-set |
| `nodeSelector` | Simple pod scheduling control | `{}` |
| `tolerations` | Allow or deny specific node taints | `{}` |
| `affinity` | Advanced pod scheduling control | `{}` |
| `securityContext.enabled` | Enable security context | `true` |
| `securityContext.fsGroup` | Group ID for the container | `1001` |
| `securityContext.runAsUser`| User ID for the container | `1001` |
The above parameters map to `memcached` params. For more information please refer to the [Memcached documentation](https://github.com/memcached/memcached/wiki/ConfiguringServer).
stable/memcached/templates/statefulset.yaml
+12
View File
@@ -27,6 +27,10 @@ spec:
{{ toYaml . | indent 8 }}
{{- end }}
spec:
{{- if .Values.securityContext.enabled }}
securityContext:
fsGroup: {{ .Values.securityContext.fsGroup }}
{{- end }}
affinity:
podAntiAffinity:
{{- if eq .Values.AntiAffinity "hard" }}
@@ -50,6 +54,10 @@ spec:
- name: {{ template "memcached.fullname" . }}
image: {{ .Values.image }}
imagePullPolicy: {{ default "" .Values.imagePullPolicy | quote }}
{{- if .Values.securityContext.enabled }}
securityContext:
runAsUser: {{ .Values.securityContext.runAsUser }}
{{- end }}
command:
- memcached
- -m {{ .Values.memcached.maxItemMemory }}
@@ -82,6 +90,10 @@ spec:
- name: metrics
image: {{ .Values.metrics.image }}
imagePullPolicy: {{ default "" .Values.metrics.imagePullPolicy | quote }}
{{- if .Values.securityContext.enabled }}
securityContext:
runAsUser: {{ .Values.securityContext.runAsUser }}
{{- end }}
ports:
- name: metrics
containerPort: 9150
stable/memcached/values.yaml
+7
View File
@@ -61,6 +61,13 @@ tolerations: {}
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
affinity: {}
## Memcached pod Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
securityContext:
enabled: true
fsGroup: 1001
runAsUser: 1001
metrics:
## Expose memcached metrics in Prometheus format
enabled: false