DevFW-CICD/ingress-nginx-helm
12
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #6356 from AlexisMtr/pod-security-context

Browse source 
Add securitycontext settings on defaultbackend
This commit is contained in:
Kubernetes Prow Robot 2020-11-02 08:14:53 -08:00 committed by GitHub
commit fb6b572378
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
charts/ingress-nginx/templates/default-backend-deployment.yaml
View file

@ -52,7 +52,13 @@ spec:
{{- end }} {{- end }}
{{- end }} {{- end }}
securityContext: securityContext:
capabilities:
drop:
- ALL
runAsUser: {{ .Values.defaultBackend.image.runAsUser }} runAsUser: {{ .Values.defaultBackend.image.runAsUser }}
runAsNonRoot: {{ .Values.defaultBackend.image.runAsNonRoot }}
allowPrivilegeEscalation: {{ .Values.defaultBackend.image.allowPrivilegeEscalation }}
readOnlyRootFilesystem: {{ .Values.defaultBackend.image.readOnlyRootFilesystem}}
{{- if .Values.defaultBackend.extraEnvs }} {{- if .Values.defaultBackend.extraEnvs }}
env: {{ toYaml .Values.defaultBackend.extraEnvs | nindent 12 }} env: {{ toYaml .Values.defaultBackend.extraEnvs | nindent 12 }}
{{- end }} {{- end }}

3
charts/ingress-nginx/values.yaml
View file

@ -555,6 +555,9 @@ defaultBackend:
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
# nobody user -> uid 65534 # nobody user -> uid 65534
runAsUser: 65534 runAsUser: 65534
runAsNonRoot: true
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
extraArgs: {} extraArgs: {}