diff --git a/stable/prometheus-operator/Chart.yaml b/stable/prometheus-operator/Chart.yaml index 9c8970df33..171c4b0c2d 100644 --- a/stable/prometheus-operator/Chart.yaml +++ b/stable/prometheus-operator/Chart.yaml @@ -9,7 +9,7 @@ name: prometheus-operator sources: - https://github.com/coreos/prometheus-operator - https://coreos.com/operators/prometheus -version: 0.1.28 +version: 0.1.29 appVersion: "0.25.0" home: https://github.com/coreos/prometheus-operator keywords: diff --git a/stable/prometheus-operator/README.md b/stable/prometheus-operator/README.md index a59318fe2a..14f5c15006 100644 --- a/stable/prometheus-operator/README.md +++ b/stable/prometheus-operator/README.md @@ -81,6 +81,7 @@ The following tables lists the configurable parameters of the prometheus-operato | `prometheusOperator.service.nodePort` | Port to expose prometheus operator service on each node | `38080` | | `prometheusOperator.service.annotations` | Annotations to be added to the prometheus operator service | `{}` | | `prometheusOperator.resources` | Resource limits for prometheus operator | `{}` | +| `prometheusOperator.securityContext` | SecurityContext for prometheus operator | `{"runAsNonRoot": true, "runAsUser": 65534}` | | `prometheusOperator.nodeSelector` | Prometheus operator node selector https://kubernetes.io/docs/user-guide/node-selection/ | `{}` | | `prometheusOperator.tolerations` | Tolerations for use with node taints https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ | `[]` | | `prometheusOperator.affinity` | Assign the prometheus operator to run on specific nodes https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ | `{}` | diff --git a/stable/prometheus-operator/templates/prometheus-operator/deployment.yaml b/stable/prometheus-operator/templates/prometheus-operator/deployment.yaml index 80776c2552..075bc16df4 100644 --- a/stable/prometheus-operator/templates/prometheus-operator/deployment.yaml +++ b/stable/prometheus-operator/templates/prometheus-operator/deployment.yaml @@ -44,9 +44,10 @@ spec: securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true +{{- if .Values.prometheusOperator.securityContext }} securityContext: - runAsNonRoot: true - runAsUser: 65534 +{{ toYaml .Values.prometheusOperator.securityContext | indent 8 }} +{{- end }} serviceAccountName: {{ template "prometheus-operator.operator.serviceAccountName" . }} {{- with .Values.prometheusOperator.nodeSelector }} nodeSelector: diff --git a/stable/prometheus-operator/values.yaml b/stable/prometheus-operator/values.yaml index 93923615a6..918fa43533 100644 --- a/stable/prometheus-operator/values.yaml +++ b/stable/prometheus-operator/values.yaml @@ -530,6 +530,10 @@ prometheusOperator: # - e2e-az1 # - e2e-az2 + securityContext: + runAsNonRoot: true + runAsUser: 65534 + ## Prometheus-operator image ## image: