From 08591fe2ac188563ea8a22bccd46c3d242326f5d Mon Sep 17 00:00:00 2001 From: Joris ANDRADE Date: Thu, 11 Jul 2019 14:26:55 +0200 Subject: [PATCH] [stable/memcached] Add security context to memcached chart (#15317) * Add security context to memcached chart Signed-off-by: Joris Andrade * Remove typo Signed-off-by: Joris Andrade * Address comments Signed-off-by: Joris Andrade --- stable/memcached/Chart.yaml | 2 +- stable/memcached/README.md | 41 +++++++++++---------- stable/memcached/templates/statefulset.yaml | 12 ++++++ stable/memcached/values.yaml | 7 ++++ 4 files changed, 42 insertions(+), 20 deletions(-) diff --git a/stable/memcached/Chart.yaml b/stable/memcached/Chart.yaml index da5b879d1f..c4a8c47735 100644 --- a/stable/memcached/Chart.yaml +++ b/stable/memcached/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: memcached -version: 2.8.3 +version: 2.9.0 appVersion: 1.5.12 description: Free & open source, high-performance, distributed memory object caching system. diff --git a/stable/memcached/README.md b/stable/memcached/README.md index 2d7a30283f..872e6092bc 100644 --- a/stable/memcached/README.md +++ b/stable/memcached/README.md @@ -40,25 +40,28 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the Memcached chart and their default values. -| Parameter | Description | Default | -|---------------------------|---------------------------------|---------------------------------------------------------| -| `image` | The image to pull and run | A recent official memcached tag | -| `imagePullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | -| `memcached.verbosity` | Verbosity level (v, vv, or vvv) | Un-set. | -| `memcached.maxItemMemory` | Max memory for items (in MB) | `64` | -| `memcached.extraArgs` | Additional memcached arguments | `[]` | -| `metrics.enabled` | Expose metrics in prometheus format | false | -| `metrics.image` | The image to pull and run for the metrics exporter | A recent official memcached tag | -| `metrics.imagePullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | -| `metrics.resources` | CPU/Memory resource requests/limits for the metrics exporter | `{}` | -| `extraContainers` | Container sidecar definition(s) as string | Un-set | -| `extraVolumes` | Volume definitions to add as string | Un-set | -| `kind` | Install as StatefulSet or Deployment | StatefulSet | -| `podAnnotations` | Map of annotations to add to the pod(s) | `{}` | -| `podLabels` | Custom Labels to be applied to statefulset | Un-set | -| `nodeSelector` | Simple pod scheduling control | `{}` | -| `tolerations` | Allow or deny specific node taints | `{}` | -| `affinity` | Advanced pod scheduling control | `{}` | +| Parameter | Description | Default | +|----------------------------|---------------------------------|---------------------------------------------------------| +| `image` | The image to pull and run | A recent official memcached tag | +| `imagePullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | +| `memcached.verbosity` | Verbosity level (v, vv, or vvv) | Un-set. | +| `memcached.maxItemMemory` | Max memory for items (in MB) | `64` | +| `memcached.extraArgs` | Additional memcached arguments | `[]` | +| `metrics.enabled` | Expose metrics in prometheus format | false | +| `metrics.image` | The image to pull and run for the metrics exporter | A recent official memcached tag | +| `metrics.imagePullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | +| `metrics.resources` | CPU/Memory resource requests/limits for the metrics exporter | `{}` | +| `extraContainers` | Container sidecar definition(s) as string | Un-set | +| `extraVolumes` | Volume definitions to add as string | Un-set | +| `kind` | Install as StatefulSet or Deployment | StatefulSet | +| `podAnnotations` | Map of annotations to add to the pod(s) | `{}` | +| `podLabels` | Custom Labels to be applied to statefulset | Un-set | +| `nodeSelector` | Simple pod scheduling control | `{}` | +| `tolerations` | Allow or deny specific node taints | `{}` | +| `affinity` | Advanced pod scheduling control | `{}` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser`| User ID for the container | `1001` | The above parameters map to `memcached` params. For more information please refer to the [Memcached documentation](https://github.com/memcached/memcached/wiki/ConfiguringServer). diff --git a/stable/memcached/templates/statefulset.yaml b/stable/memcached/templates/statefulset.yaml index 9d1bac3705..0eb5ced206 100644 --- a/stable/memcached/templates/statefulset.yaml +++ b/stable/memcached/templates/statefulset.yaml @@ -27,6 +27,10 @@ spec: {{ toYaml . | indent 8 }} {{- end }} spec: + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + {{- end }} affinity: podAntiAffinity: {{- if eq .Values.AntiAffinity "hard" }} @@ -50,6 +54,10 @@ spec: - name: {{ template "memcached.fullname" . }} image: {{ .Values.image }} imagePullPolicy: {{ default "" .Values.imagePullPolicy | quote }} + {{- if .Values.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} command: - memcached - -m {{ .Values.memcached.maxItemMemory }} @@ -82,6 +90,10 @@ spec: - name: metrics image: {{ .Values.metrics.image }} imagePullPolicy: {{ default "" .Values.metrics.imagePullPolicy | quote }} + {{- if .Values.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} ports: - name: metrics containerPort: 9150 diff --git a/stable/memcached/values.yaml b/stable/memcached/values.yaml index e0f2cd2029..6ab55619a1 100644 --- a/stable/memcached/values.yaml +++ b/stable/memcached/values.yaml @@ -61,6 +61,13 @@ tolerations: {} ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ affinity: {} +## Memcached pod Security Context +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +securityContext: + enabled: true + fsGroup: 1001 + runAsUser: 1001 + metrics: ## Expose memcached metrics in Prometheus format enabled: false