From 9548653de73b4017d3ff815011fd6fe75a1918da Mon Sep 17 00:00:00 2001 From: Ke Zhu Date: Wed, 1 May 2019 00:54:56 -0400 Subject: [PATCH] [stable/mysql] New configuration securityContext for the chart mysql (#12538) * Adds security context for mysql pod Signed-off-by: Ke Zhu * Bumps minor version number for the chart mysql Signed-off-by: Ke Zhu --- stable/mysql/Chart.yaml | 2 +- stable/mysql/README.md | 3 +++ stable/mysql/templates/deployment.yaml | 5 +++++ stable/mysql/values.yaml | 6 ++++++ 4 files changed, 15 insertions(+), 1 deletion(-) diff --git a/stable/mysql/Chart.yaml b/stable/mysql/Chart.yaml index 4c7f06ce6e..687ed3bcb4 100755 --- a/stable/mysql/Chart.yaml +++ b/stable/mysql/Chart.yaml @@ -1,5 +1,5 @@ name: mysql -version: 0.17.0 +version: 0.19.0 appVersion: 5.7.14 description: Fast, reliable, scalable, and easy to use open-source relational database system. diff --git a/stable/mysql/README.md b/stable/mysql/README.md index e3bfa197ad..1585eab0fa 100755 --- a/stable/mysql/README.md +++ b/stable/mysql/README.md @@ -92,6 +92,9 @@ The following table lists the configurable parameters of the MySQL chart and the | `metrics.readinessProbe.timeoutSeconds` | When the probe times out | 1 | | `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `100m` | | `configurationFiles` | List of mysql configuration files | `nil` | +| `securityContext.enabled` | Enable security context (mysql pod) | `false` | +| `securityContext.fsGroup` | Group ID for the container (mysql pod) | 999 | +| `securityContext.runAsUser` | User ID for the container (mysql pod) | 999 | | `service.annotations` | Kubernetes annotations for mysql | {} | | `ssl.enabled` | Setup and use SSL for MySQL connections | `false` | | `ssl.secret` | Name of the secret containing the SSL certificates | mysql-ssl-certs | diff --git a/stable/mysql/templates/deployment.yaml b/stable/mysql/templates/deployment.yaml index 27d4113b42..310e2c5df1 100644 --- a/stable/mysql/templates/deployment.yaml +++ b/stable/mysql/templates/deployment.yaml @@ -27,6 +27,11 @@ spec: {{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} initContainers: - name: "remove-lost-found" image: "{{ .Values.busybox.image}}:{{ .Values.busybox.tag }}" diff --git a/stable/mysql/values.yaml b/stable/mysql/values.yaml index 4d888540c8..a9e47a3b18 100644 --- a/stable/mysql/values.yaml +++ b/stable/mysql/values.yaml @@ -95,6 +95,12 @@ persistence: size: 8Gi annotations: {} +## Security context +securityContext: + enabled: false + runAsUser: 999 + fsGroup: 999 + ## Configure resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ##