github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

[stable/elasticsearch] Run as non-root (#13429)

Browse Source 
* Various

Signed-off-by: Naseem <naseemkullah@gmail.com>

* Option to run as elasticsearch, not root

Signed-off-by: Naseem <naseemkullah@gmail.com>
This commit is contained in:
Naseem
2019-05-21 21:44:04 -07:00
committed by Kubernetes Prow Robot
parent a09be94d88
commit bb6500de3b
6 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/elasticsearch/Chart.yaml
+1 -1
View File
@@ -1,7 +1,7 @@
apiVersion: v1
name: elasticsearch
home: https://www.elastic.co/products/elasticsearch
version: 1.26.2
version: 1.27.2
appVersion: 6.7.0
description: Flexible and powerful open source, distributed real-time search and analytics
engine.
stable/elasticsearch/README.md
+4 -2
View File
@@ -146,9 +146,11 @@ The following table lists the configurable parameters of the elasticsearch chart
| `data.updateStrategy` | Data node update strategy policy | `{type: "onDelete"}` |
| `sysctlInitContainer.enabled` | If true, the sysctl init container is enabled (does not stop extraInitContainers from running) | `true` |
| `extraInitContainers` | Additional init container passed through the tpl | `` |
| `podSecurityPolicy.annotations` | Specify pod annotations in the pod security policy | `{}` |
| `podSecurityPolicy.annotations` | Specify pod annotations in the pod security policy | `{}` |
| `podSecurityPolicy.enabled` | Specify if a pod security policy must be created | `false` |
| `serviceAccounts.client.create` | If true, create the client service account | `true` |
| `securityContext.enabled` | If true, add securityContext to client, master and data pods | `false` |
| `securityContext.runAsUser` | user ID to run containerized process | `1000` |
| `serviceAccounts.client.create` | If true, create the client service account | `true` |
| `serviceAccounts.client.name` | Name of the client service account to use or create | `{{ elasticsearch.client.fullname }}` |
| `serviceAccounts.master.create` | If true, create the master service account | `true` |
| `serviceAccounts.master.name` | Name of the master service account to use or create | `{{ elasticsearch.master.fullname }}` |
stable/elasticsearch/templates/client-deployment.yaml
+4
View File
@@ -121,6 +121,10 @@ spec:
initialDelaySeconds: 90
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
{{- if .Values.securityContext.enabled }}
securityContext:
runAsUser: {{ .Values.securityContext.runAsUser }}
{{- end }}
ports:
- containerPort: 9200
name: http
stable/elasticsearch/templates/data-statefulset.yaml
+4
View File
@@ -127,6 +127,10 @@ spec:
{{- end }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
{{- if .Values.securityContext.enabled }}
securityContext:
runAsUser: {{ .Values.securityContext.runAsUser }}
{{- end }}
ports:
- containerPort: 9300
name: transport
stable/elasticsearch/templates/master-statefulset.yaml
+4
View File
@@ -135,6 +135,10 @@ spec:
{{ toYaml .Values.master.readinessProbe | indent 10 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
{{- if .Values.securityContext.enabled }}
securityContext:
runAsUser: {{ .Values.securityContext.runAsUser }}
{{- end }}
ports:
- containerPort: 9300
name: transport
stable/elasticsearch/values.yaml
+4
View File
@@ -31,6 +31,10 @@ podSecurityPolicy:
# seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
# apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
securityContext:
enabled: false
runAsUser: 1000
image:
repository: "docker.elastic.co/elasticsearch/elasticsearch-oss"
tag: "6.7.0"