From 0c101b4abc615a8bf20a5875ca2b9bfc39832aba Mon Sep 17 00:00:00 2001 From: Boris Kurktchiev Date: Tue, 8 Jan 2019 09:08:23 -0500 Subject: [PATCH] Add support for SELinux label modification (#9778) * Add support for SELinux label modification in case the default SPC_T one does not work on a system Signed-off-by: Boris Kurktchiev * resolve PR comments Signed-off-by: Boris Kurktchiev * resolve the PR comments properly... Signed-off-by: Boris Kurktchiev * resolve comments Signed-off-by: Boris Kurktchiev --- stable/datadog/Chart.yaml | 2 +- stable/datadog/README.md | 1 + stable/datadog/templates/daemonset.yaml | 4 ++++ stable/datadog/templates/deployment.yaml | 4 ++++ stable/datadog/values.yaml | 6 ++++++ 5 files changed, 16 insertions(+), 1 deletion(-) diff --git a/stable/datadog/Chart.yaml b/stable/datadog/Chart.yaml index d91936c891..e24540cb2f 100755 --- a/stable/datadog/Chart.yaml +++ b/stable/datadog/Chart.yaml @@ -1,5 +1,5 @@ name: datadog -version: 1.14.0 +version: 1.15.0 appVersion: 6.6.0 description: DataDog Agent keywords: diff --git a/stable/datadog/README.md b/stable/datadog/README.md index 9893328213..6dabb43329 100644 --- a/stable/datadog/README.md +++ b/stable/datadog/README.md @@ -91,6 +91,7 @@ The following table lists the configurable parameters of the Datadog chart and t | `datadog.resources.limits.cpu` | CPU resource limits | `200m` | | `datadog.resources.requests.memory` | Memory resource requests | `256Mi` | | `datadog.resources.limits.memory` | Memory resource limits | `256Mi` | +| `datadog.securityContext` | Allows you to overwrite the default securityContext applied to the container | `nil` | | `datadog.livenessProbe` | Overrides the default liveness probe | exec /probe.sh | | `daemonset.podAnnotations` | Annotations to add to the DaemonSet's Pods | `nil` | | `daemonset.tolerations` | List of node taints to tolerate (requires Kubernetes >= 1.6) | `nil` | diff --git a/stable/datadog/templates/daemonset.yaml b/stable/datadog/templates/daemonset.yaml index 9843f8644e..7a8f78bae7 100644 --- a/stable/datadog/templates/daemonset.yaml +++ b/stable/datadog/templates/daemonset.yaml @@ -23,6 +23,10 @@ spec: {{ toYaml .Values.daemonset.podAnnotations | indent 8 }} {{- end }} spec: + {{- if .Values.datadog.securityContext }} + securityContext: +{{ toYaml .Values.datadog.securityContext | indent 8 }} + {{- end }} {{- if .Values.daemonset.useHostNetwork }} hostNetwork: {{ .Values.daemonset.useHostNetwork }} dnsPolicy: ClusterFirstWithHostNet diff --git a/stable/datadog/templates/deployment.yaml b/stable/datadog/templates/deployment.yaml index 134c5731fa..836b72811a 100644 --- a/stable/datadog/templates/deployment.yaml +++ b/stable/datadog/templates/deployment.yaml @@ -22,6 +22,10 @@ spec: checksum/confd-config: {{ tpl (toYaml .Values.datadog.confd) . | sha256sum }} checksum/checksd-config: {{ tpl (toYaml .Values.datadog.checksd) . | sha256sum }} spec: + {{- if .Values.datadog.securityContext }} + securityContext: +{{ toYaml .Values.datadog.securityContext | indent 8 }} + {{- end }} {{- if .Values.image.pullSecrets }} imagePullSecrets: {{ toYaml .Values.image.pullSecrets | indent 8 }} diff --git a/stable/datadog/values.yaml b/stable/datadog/values.yaml index 34aeab628e..181d609c3e 100644 --- a/stable/datadog/values.yaml +++ b/stable/datadog/values.yaml @@ -129,6 +129,12 @@ datadog: ## # apiKey: + ## You can modify the security context used to run the containers by + ## modifying the label type below: + # securityContext: + # seLinuxOptions: + # seLinuxLabel: "spc_t" + ## Use existing Secret which stores API key instead of creating a new one # apiKeyExistingSecret: