diff --git a/stable/kuberhealthy/Chart.yaml b/stable/kuberhealthy/Chart.yaml index 860d8d6ac2..8fccf6f858 100644 --- a/stable/kuberhealthy/Chart.yaml +++ b/stable/kuberhealthy/Chart.yaml @@ -3,7 +3,7 @@ appVersion: "1.0.0" home: https://comcast.github.io/kuberhealthy/ description: The official Helm chart for Kuberhealthy. name: kuberhealthy -version: 1.0.2 +version: 1.1.0 maintainers: - name: integrii email: eric.greer@comcast.com diff --git a/stable/kuberhealthy/README.md b/stable/kuberhealthy/README.md index 31b30c3f4c..93ea6999f8 100644 --- a/stable/kuberhealthy/README.md +++ b/stable/kuberhealthy/README.md @@ -54,6 +54,11 @@ deployment: maxUnavailable: 1 imagePullPolicy: IfNotPresent namespace: kuberhealthy +securityContext: # default container security context + runAsNonRoot: true + runAsUser: 999 + fsGroup: 999 + allowPrivilegeEscalation: false ``` diff --git a/stable/kuberhealthy/templates/deployment.yaml b/stable/kuberhealthy/templates/deployment.yaml index 6ad4e85c8b..27456c2749 100644 --- a/stable/kuberhealthy/templates/deployment.yaml +++ b/stable/kuberhealthy/templates/deployment.yaml @@ -30,6 +30,8 @@ spec: automountServiceAccountToken: true containers: - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} + securityContext: + {{- toYaml .Values.securityContext | nindent 10 -}} imagePullPolicy: {{ .Values.deployment.imagePullPolicy }} livenessProbe: failureThreshold: 3 diff --git a/stable/kuberhealthy/values.yaml b/stable/kuberhealthy/values.yaml index 7fab74ad4d..6236f76a87 100644 --- a/stable/kuberhealthy/values.yaml +++ b/stable/kuberhealthy/values.yaml @@ -31,6 +31,12 @@ deployment: maxUnavailable: 1 imagePullPolicy: IfNotPresent +securityContext: + runAsNonRoot: true + runAsUser: 999 + fsGroup: 999 + allowPrivilegeEscalation: false + # Please remember that changing the service type to LoadBalancer # will expose Kuberhealthy to the internet, which could cause # error messages shown by Kuberhealthy to be exposed to the