From bb6500de3b2447b8547de990127baebb40ea2e42 Mon Sep 17 00:00:00 2001 From: Naseem Date: Wed, 22 May 2019 00:44:04 -0400 Subject: [PATCH] [stable/elasticsearch] Run as non-root (#13429) * Various Signed-off-by: Naseem * Option to run as elasticsearch, not root Signed-off-by: Naseem --- stable/elasticsearch/Chart.yaml | 2 +- stable/elasticsearch/README.md | 6 ++++-- stable/elasticsearch/templates/client-deployment.yaml | 4 ++++ stable/elasticsearch/templates/data-statefulset.yaml | 4 ++++ stable/elasticsearch/templates/master-statefulset.yaml | 4 ++++ stable/elasticsearch/values.yaml | 4 ++++ 6 files changed, 21 insertions(+), 3 deletions(-) diff --git a/stable/elasticsearch/Chart.yaml b/stable/elasticsearch/Chart.yaml index a9cadcabb0..c29b4f05dc 100755 --- a/stable/elasticsearch/Chart.yaml +++ b/stable/elasticsearch/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: elasticsearch home: https://www.elastic.co/products/elasticsearch -version: 1.26.2 +version: 1.27.2 appVersion: 6.7.0 description: Flexible and powerful open source, distributed real-time search and analytics engine. diff --git a/stable/elasticsearch/README.md b/stable/elasticsearch/README.md index f4c0610411..3d2a6478f9 100644 --- a/stable/elasticsearch/README.md +++ b/stable/elasticsearch/README.md @@ -146,9 +146,11 @@ The following table lists the configurable parameters of the elasticsearch chart | `data.updateStrategy` | Data node update strategy policy | `{type: "onDelete"}` | | `sysctlInitContainer.enabled` | If true, the sysctl init container is enabled (does not stop extraInitContainers from running) | `true` | | `extraInitContainers` | Additional init container passed through the tpl | `` | -| `podSecurityPolicy.annotations` | Specify pod annotations in the pod security policy | `{}` | +| `podSecurityPolicy.annotations` | Specify pod annotations in the pod security policy | `{}` | | `podSecurityPolicy.enabled` | Specify if a pod security policy must be created | `false` | -| `serviceAccounts.client.create` | If true, create the client service account | `true` | +| `securityContext.enabled` | If true, add securityContext to client, master and data pods | `false` | +| `securityContext.runAsUser` | user ID to run containerized process | `1000` | +| `serviceAccounts.client.create` | If true, create the client service account | `true` | | `serviceAccounts.client.name` | Name of the client service account to use or create | `{{ elasticsearch.client.fullname }}` | | `serviceAccounts.master.create` | If true, create the master service account | `true` | | `serviceAccounts.master.name` | Name of the master service account to use or create | `{{ elasticsearch.master.fullname }}` | diff --git a/stable/elasticsearch/templates/client-deployment.yaml b/stable/elasticsearch/templates/client-deployment.yaml index 047e3c8f3e..e7d111dae4 100644 --- a/stable/elasticsearch/templates/client-deployment.yaml +++ b/stable/elasticsearch/templates/client-deployment.yaml @@ -121,6 +121,10 @@ spec: initialDelaySeconds: 90 image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} ports: - containerPort: 9200 name: http diff --git a/stable/elasticsearch/templates/data-statefulset.yaml b/stable/elasticsearch/templates/data-statefulset.yaml index a40780311e..b241da4196 100644 --- a/stable/elasticsearch/templates/data-statefulset.yaml +++ b/stable/elasticsearch/templates/data-statefulset.yaml @@ -127,6 +127,10 @@ spec: {{- end }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} ports: - containerPort: 9300 name: transport diff --git a/stable/elasticsearch/templates/master-statefulset.yaml b/stable/elasticsearch/templates/master-statefulset.yaml index 048535c75e..056ca3d5c7 100644 --- a/stable/elasticsearch/templates/master-statefulset.yaml +++ b/stable/elasticsearch/templates/master-statefulset.yaml @@ -135,6 +135,10 @@ spec: {{ toYaml .Values.master.readinessProbe | indent 10 }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} ports: - containerPort: 9300 name: transport diff --git a/stable/elasticsearch/values.yaml b/stable/elasticsearch/values.yaml index b8a7b9cd04..7d72e723e2 100644 --- a/stable/elasticsearch/values.yaml +++ b/stable/elasticsearch/values.yaml @@ -31,6 +31,10 @@ podSecurityPolicy: # seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' # apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' +securityContext: + enabled: false + runAsUser: 1000 + image: repository: "docker.elastic.co/elasticsearch/elasticsearch-oss" tag: "6.7.0"