DevFW-CICD/ingress-nginx-helm
14
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add:(admission-webhooks) ability to set securityContext for job-containers createSecret and patchWebhook (#9186)

Browse source 
Signed-off-by: ybelMekk <youssef.bel.mekki@nav.no>

Signed-off-by: ybelMekk <youssef.bel.mekki@nav.no>
This commit is contained in:
Youssef Bel Mekki 2022-10-25 23:14:36 +02:00 committed by GitHub
parent a383cfc551
commit ac1a3363bd
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 12 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
charts/ingress-nginx/README.md
View file

@ -242,6 +242,7 @@ Kubernetes: `>=1.20.0-0`
| controller.admissionWebhooks.annotations | object | `{}` | | | controller.admissionWebhooks.annotations | object | `{}` | |
| controller.admissionWebhooks.certificate | string | `"/usr/local/certificates/cert"` | | | controller.admissionWebhooks.certificate | string | `"/usr/local/certificates/cert"` | |
| controller.admissionWebhooks.createSecretJob.resources | object | `{}` | | | controller.admissionWebhooks.createSecretJob.resources | object | `{}` | |
| controller.admissionWebhooks.createSecretJob.securityContext.allowPrivilegeEscalation | bool | `false` | |
| controller.admissionWebhooks.enabled | bool | `true` | | | controller.admissionWebhooks.enabled | bool | `true` | |
| controller.admissionWebhooks.existingPsp | string | `""` | Use an existing PSP instead of creating one | | controller.admissionWebhooks.existingPsp | string | `""` | Use an existing PSP instead of creating one |
| controller.admissionWebhooks.extraEnvs | list | `[]` | Additional environment variables to set | | controller.admissionWebhooks.extraEnvs | list | `[]` | Additional environment variables to set |
@ -266,6 +267,7 @@ Kubernetes: `>=1.20.0-0`
| controller.admissionWebhooks.patch.securityContext.runAsUser | int | `2000` | | | controller.admissionWebhooks.patch.securityContext.runAsUser | int | `2000` | |
| controller.admissionWebhooks.patch.tolerations | list | `[]` | | | controller.admissionWebhooks.patch.tolerations | list | `[]` | |
| controller.admissionWebhooks.patchWebhookJob.resources | object | `{}` | | | controller.admissionWebhooks.patchWebhookJob.resources | object | `{}` | |
| controller.admissionWebhooks.patchWebhookJob.securityContext.allowPrivilegeEscalation | bool | `false` | |
| controller.admissionWebhooks.port | int | `8443` | | | controller.admissionWebhooks.port | int | `8443` | |
| controller.admissionWebhooks.service.annotations | object | `{}` | | | controller.admissionWebhooks.service.annotations | object | `{}` | |
| controller.admissionWebhooks.service.externalIPs | list | `[]` | | | controller.admissionWebhooks.service.externalIPs | list | `[]` | |

5
charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
View file

@ -59,8 +59,9 @@ spec:
{{- if .Values.controller.admissionWebhooks.extraEnvs }} {{- if .Values.controller.admissionWebhooks.extraEnvs }}
{{- toYaml .Values.controller.admissionWebhooks.extraEnvs | nindent 12 }} {{- toYaml .Values.controller.admissionWebhooks.extraEnvs | nindent 12 }}
{{- end }} {{- end }}
securityContext: {{- if .Values.controller.admissionWebhooks.createSecretJob.securityContext }}
allowPrivilegeEscalation: false securityContext: {{ toYaml .Values.controller.admissionWebhooks.createSecretJob.securityContext | nindent 12 }}
{{- end }}
{{- if .Values.controller.admissionWebhooks.createSecretJob.resources }} {{- if .Values.controller.admissionWebhooks.createSecretJob.resources }}
resources: {{ toYaml .Values.controller.admissionWebhooks.createSecretJob.resources | nindent 12 }} resources: {{ toYaml .Values.controller.admissionWebhooks.createSecretJob.resources | nindent 12 }}
{{- end }} {{- end }}

5
charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
View file

@ -61,8 +61,9 @@ spec:
{{- if .Values.controller.admissionWebhooks.extraEnvs }} {{- if .Values.controller.admissionWebhooks.extraEnvs }}
{{- toYaml .Values.controller.admissionWebhooks.extraEnvs | nindent 12 }} {{- toYaml .Values.controller.admissionWebhooks.extraEnvs | nindent 12 }}
{{- end }} {{- end }}
securityContext: {{- if .Values.controller.admissionWebhooks.patchWebhookJob.securityContext }}
allowPrivilegeEscalation: false securityContext: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.securityContext | nindent 12 }}
{{- end }}
{{- if .Values.controller.admissionWebhooks.patchWebhookJob.resources }} {{- if .Values.controller.admissionWebhooks.patchWebhookJob.resources }}
resources: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.resources | nindent 12 }} resources: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.resources | nindent 12 }}
{{- end }} {{- end }}

4
charts/ingress-nginx/values.yaml
View file

@ -627,6 +627,8 @@ controller:
type: ClusterIP type: ClusterIP
createSecretJob: createSecretJob:
securityContext:
allowPrivilegeEscalation: false
resources: {} resources: {}
# limits: # limits:
# cpu: 10m # cpu: 10m
@ -636,6 +638,8 @@ controller:
# memory: 20Mi # memory: 20Mi
patchWebhookJob: patchWebhookJob:
securityContext:
allowPrivilegeEscalation: false
resources: {} resources: {}
patch: patch: