From 5b434d3aefcbdcc231423713fb11b5dd72b8f76d Mon Sep 17 00:00:00 2001 From: matejhasul Date: Tue, 5 Mar 2019 16:44:01 +0100 Subject: [PATCH] [rabbitmq-ha] Set securityContext for rabbitmq container (#11863) * [stable/rabbitmq-ha] Set securityContext for rabbitmq container Default values are compatible with default image (rabbitmq:3.7-alpine). Note that securityContext is set on container level which means it affects only rabbitmq container. Increase only bugfix part of chart version because default `securityContext.enabled` is false. Signed-off-by: hasul * TEST: Make linter happy There were 3 empty lines but linter tolerates only 2 Signed-off-by: hasul * Increase minor version instead of patch version Signed-off-by: hasul * Remove securityContext.enabled Signed-off-by: hasul * Use toYaml to set all securityContext values Signed-off-by: hasul * Move securityContext on pod level Signed-off-by: hasul * Increase only minor version and not also patch version Signed-off-by: hasul --- stable/rabbitmq-ha/Chart.yaml | 2 +- stable/rabbitmq-ha/README.md | 3 +++ stable/rabbitmq-ha/templates/statefulset.yaml | 2 ++ stable/rabbitmq-ha/values.yaml | 8 ++++++++ 4 files changed, 14 insertions(+), 1 deletion(-) diff --git a/stable/rabbitmq-ha/Chart.yaml b/stable/rabbitmq-ha/Chart.yaml index fcde0d358d..fbcf0aef67 100644 --- a/stable/rabbitmq-ha/Chart.yaml +++ b/stable/rabbitmq-ha/Chart.yaml @@ -1,7 +1,7 @@ name: rabbitmq-ha apiVersion: v1 appVersion: 3.7.8 -version: 1.20.1 +version: 1.21.0 description: Highly available RabbitMQ cluster, the open source message broker software that implements the Advanced Message Queuing Protocol (AMQP). keywords: diff --git a/stable/rabbitmq-ha/README.md b/stable/rabbitmq-ha/README.md index 4118277f54..107c57ec2a 100644 --- a/stable/rabbitmq-ha/README.md +++ b/stable/rabbitmq-ha/README.md @@ -138,6 +138,9 @@ and their default values. | `rbac.create` | If true, create & use RBAC resources | `true` | | `replicaCount` | Number of replica | `3` | | `resources` | CPU/Memory resource requests/limits | `{}` | +| `securityContext.runAsGroup` | Group ID for the container | `101` | +| `securityContext.runAsNonRoot` | Enforce non-root user ID for the container | `true` | +| `securityContext.runAsUser` | User ID for the container | `100` | | `serviceAccount.create` | Create service account | `true` | | `serviceAccount.name` | Service account name to use | _name of the release_ | | `service.annotations` | Annotations to add to the service | `{}` | diff --git a/stable/rabbitmq-ha/templates/statefulset.yaml b/stable/rabbitmq-ha/templates/statefulset.yaml index 3bce97a6c7..35f53a8961 100644 --- a/stable/rabbitmq-ha/templates/statefulset.yaml +++ b/stable/rabbitmq-ha/templates/statefulset.yaml @@ -39,6 +39,8 @@ spec: {{- end }} {{- end }} terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} + securityContext: +{{ toYaml .Values.securityContext | indent 10 }} serviceAccountName: {{ template "rabbitmq-ha.serviceAccountName" . }} initContainers: - name: copy-rabbitmq-config diff --git a/stable/rabbitmq-ha/values.yaml b/stable/rabbitmq-ha/values.yaml index 759163a69f..6887715811 100644 --- a/stable/rabbitmq-ha/values.yaml +++ b/stable/rabbitmq-ha/values.yaml @@ -433,6 +433,14 @@ readinessProbe: # Specifies an existing secret to be used for RMQ password and Erlang Cookie existingSecret: "" + +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +## +securityContext: + runAsGroup: 101 + runAsNonRoot: true + runAsUser: 100 + prometheus: ## Configures Prometheus Exporter to expose and scrape stats. exporter: