diff --git a/stable/kubernetes-dashboard/Chart.yaml b/stable/kubernetes-dashboard/Chart.yaml index ef9967b36c..9aa32ef99c 100644 --- a/stable/kubernetes-dashboard/Chart.yaml +++ b/stable/kubernetes-dashboard/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: kubernetes-dashboard -version: 1.8.0 +version: 1.9.0 appVersion: 1.10.1 description: General-purpose web UI for Kubernetes clusters keywords: diff --git a/stable/kubernetes-dashboard/README.md b/stable/kubernetes-dashboard/README.md index f87db55abd..098029eb29 100644 --- a/stable/kubernetes-dashboard/README.md +++ b/stable/kubernetes-dashboard/README.md @@ -53,6 +53,7 @@ The following table lists the configurable parameters of the kubernetes-dashboar | `extraArgs` | Additional container arguments | `[]` | | `extraEnv` | Additional container environment variables | `[]` | | `podAnnotations` | Annotations to be added to pods | {} | +| `dashboardContainerSecurityContext` | SecurityContext for the kubernetes dashboard container | {} | | `nodeSelector` | node labels for pod assignment | `{}` | | `tolerations` | List of node taints to tolerate (requires Kubernetes >= 1.6) | `[]` | | `affinity` | Affinity for pod assignment | `[]` | @@ -78,7 +79,7 @@ The following table lists the configurable parameters of the kubernetes-dashboar | `podDisruptionBudget.enabled` | Create a PodDisruptionBudget | `false` | | `podDisruptionBudget.minAvailable` | Minimum available instances; ignored if there is no PodDisruptionBudget | | | `podDisruptionBudget.maxUnavailable`| Maximum unavailable instances; ignored if there is no PodDisruptionBudget | | -| `securityContext` | Security context | `{}` | +| `securityContext` | PodSecurityContext for pod level securityContext | `{}` | | `networkPolicy` | Whether to create a network policy that allows access to the service | `false` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, diff --git a/stable/kubernetes-dashboard/templates/deployment.yaml b/stable/kubernetes-dashboard/templates/deployment.yaml index 26610063b2..bc2ff71bf9 100644 --- a/stable/kubernetes-dashboard/templates/deployment.yaml +++ b/stable/kubernetes-dashboard/templates/deployment.yaml @@ -89,6 +89,10 @@ spec: {{- end }} initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} +{{- if .Values.dashboardContainerSecurityContext }} + securityContext: +{{ toYaml .Values.dashboardContainerSecurityContext | indent 10 }} +{{- end }} resources: {{ toYaml .Values.resources | indent 10 }} {{- if .Values.image.pullSecrets }} diff --git a/stable/kubernetes-dashboard/values.yaml b/stable/kubernetes-dashboard/values.yaml index 34153dd845..560b0ebce4 100644 --- a/stable/kubernetes-dashboard/values.yaml +++ b/stable/kubernetes-dashboard/values.yaml @@ -39,8 +39,21 @@ extraEnv: [] # value: 'some value' # Annotations to be added to kubernetes dashboard pods +## Recommended value +# podAnnotations: +# seccomp.security.alpha.kubernetes.io/pod: 'runtime/default' podAnnotations: {} +## SecurityContext for the kubernetes dashboard container +## Recommended values +# dashboardContainerSecurityContext: +# allowPrivilegeEscalation: false +# readOnlyRootFilesystem: true +## The two values below can be set here or at podLevel (using variable .securityContext) +# runAsUser: 1001 +# runAsGroup: 2001 +dashboardContainerSecurityContext: {} + ## Node labels for pod assignment ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ ## @@ -174,6 +187,12 @@ podDisruptionBudget: minAvailable: maxUnavailable: + +## PodSecurityContext for pod level securityContext +## +# securityContext: +# runAsUser: 1001 +# runAsGroup: 2001 securityContext: {} networkPolicy: false