github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

[rabbitmq-ha] Set securityContext for rabbitmq container (#11863)

Browse Source 
* [stable/rabbitmq-ha] Set securityContext for rabbitmq container

Default values are compatible with default image (rabbitmq:3.7-alpine).

Note that securityContext is set on container level which means it affects only rabbitmq container.

Increase only bugfix part of chart version because default `securityContext.enabled` is false.

Signed-off-by: hasul <matej.hasul@gooddata.com>

* TEST: Make linter happy

There were 3 empty lines but linter tolerates only 2

Signed-off-by: hasul <matej.hasul@gooddata.com>

* Increase minor version instead of patch version

Signed-off-by: hasul <matej.hasul@gooddata.com>

* Remove securityContext.enabled

Signed-off-by: hasul <matej.hasul@gooddata.com>

* Use toYaml to set all securityContext values

Signed-off-by: hasul <matej.hasul@gooddata.com>

* Move securityContext on pod level

Signed-off-by: hasul <matej.hasul@gooddata.com>

* Increase only minor version and not also patch version

Signed-off-by: hasul <matej.hasul@gooddata.com>
This commit is contained in:
matejhasul
2019-03-05 07:44:01 -08:00
committed by Kubernetes Prow Robot
parent ca08a620a3
commit 5b434d3aef
4 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/rabbitmq-ha/Chart.yaml
+1 -1
View File
@@ -1,7 +1,7 @@
name: rabbitmq-ha
apiVersion: v1
appVersion: 3.7.8
version: 1.20.1
version: 1.21.0
description: Highly available RabbitMQ cluster, the open source message broker
software that implements the Advanced Message Queuing Protocol (AMQP).
keywords:
stable/rabbitmq-ha/README.md
+3
View File
@@ -138,6 +138,9 @@ and their default values.
| `rbac.create` | If true, create & use RBAC resources | `true` |
| `replicaCount` | Number of replica | `3` |
| `resources` | CPU/Memory resource requests/limits | `{}` |
| `securityContext.runAsGroup` | Group ID for the container | `101` |
| `securityContext.runAsNonRoot` | Enforce non-root user ID for the container | `true` |
| `securityContext.runAsUser` | User ID for the container | `100` |
| `serviceAccount.create` | Create service account | `true` |
| `serviceAccount.name` | Service account name to use | _name of the release_ |
| `service.annotations` | Annotations to add to the service | `{}` |
stable/rabbitmq-ha/templates/statefulset.yaml
+2
View File
@@ -39,6 +39,8 @@ spec:
{{- end }}
{{- end }}
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
securityContext:
{{ toYaml .Values.securityContext | indent 10 }}
serviceAccountName: {{ template "rabbitmq-ha.serviceAccountName" . }}
initContainers:
- name: copy-rabbitmq-config
stable/rabbitmq-ha/values.yaml
+8
View File
@@ -433,6 +433,14 @@ readinessProbe:
# Specifies an existing secret to be used for RMQ password and Erlang Cookie
existingSecret: ""
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
##
securityContext:
runAsGroup: 101
runAsNonRoot: true
runAsUser: 100
prometheus:
## Configures Prometheus Exporter to expose and scrape stats.
exporter: