summaryrefslogtreecommitdiffstats
path: root/kubernetes/consul/templates/deployment.yaml
diff options
context:
space:
mode:
authorKrzysztof Opasiak <k.opasiak@samsung.com>2020-11-25 16:54:36 +0100
committerSylvain Desbureaux <sylvain.desbureaux@orange.com>2020-11-27 14:12:09 +0000
commit217acfdf611de5bc52246acedcf248e32712f561 (patch)
tree65dd97f0cc4783b7859c66c1c42a46a4ab43d554 /kubernetes/consul/templates/deployment.yaml
parenta6fa6b1fe4c8c9b8e2a3e29b364dc96804404a9c (diff)
[CONSUL] Make consul run as non-root
Use our recently build consul image (still based on the same old consul version) and modify the deployment to make sure that it is able to run as non-root user. Yes, I know that moving consul-server to component would be more proper solution but as this commit is supposed to be cherry-picked to guilin I've tried to make as little changes as possible. Issue-ID: REQ-362 Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com> Change-Id: Idfc09ee225d4f89bb699683fa5e4ae3b86491c08
Diffstat (limited to 'kubernetes/consul/templates/deployment.yaml')
-rw-r--r--kubernetes/consul/templates/deployment.yaml41
1 files changed, 32 insertions, 9 deletions
diff --git a/kubernetes/consul/templates/deployment.yaml b/kubernetes/consul/templates/deployment.yaml
index be15ecbca6..31546abd49 100644
--- a/kubernetes/consul/templates/deployment.yaml
+++ b/kubernetes/consul/templates/deployment.yaml
@@ -39,15 +39,36 @@ spec:
spec:
imagePullSecrets:
- name: "{{ include "common.namespace" . }}-docker-registry-key"
- containers:
- - image: {{ include "repositoryGenerator.dockerHubRepository" . }}/{{ .Values.image }}
+ initContainers:
+ - name: {{ include "common.name" . }}-chown
+ image: {{ .Values.global.busyboxRepository | default .Values.busyboxRepository }}/{{ .Values.global.busyboxImage | default .Values.busyboxImage }}
command:
- - /bin/sh
- - "-c"
+ - sh
+ args:
+ - -c
- |
- apk update && apk add jq
- cp /tmp/consul/config/* /consul/config
- /usr/local/bin/docker-entrypoint.sh agent -client 0.0.0.0 -enable-script-checks -retry-join {{ .Values.consulServer.nameOverride }}
+ cp -r -L /tmp/consul/config/* /consul/config/
+ chown -R {{ .Values.consulUID }}:{{ .Values.consulGID }} /consul/config
+ ls -la /consul/config
+ volumeMounts:
+ - mountPath: /tmp/consul/config
+ name: consul-agent-config
+ - mountPath: /consul/config
+ name: consul-agent-config-dir
+ containers:
+ - image: {{ include "repositoryGenerator.repository" . }}/{{ .Values.image }}
+ securityContext:
+ runAsUser: {{ .Values.securityContext.runAsUser }}
+ runAsGroup: {{ .Values.securityContext.runAsGroup }}
+ command:
+ - docker-entrypoint.sh
+ args:
+ - agent
+ - -client
+ - 0.0.0.0
+ - -enable-script-checks
+ - -retry-join
+ - {{ .Values.consulServer.nameOverride }}
name: {{ include "common.name" . }}
env:
- name: SDNC_ODL_COUNT
@@ -55,14 +76,16 @@ spec:
- name: SDNC_IS_PRIMARY_CLUSTER
value: "{{ .Values.sdnc.config.isPrimaryCluster }}"
volumeMounts:
- - mountPath: /tmp/consul/config
- name: consul-agent-config
+ - mountPath: /consul/config
+ name: consul-agent-config-dir
- mountPath: /consul/scripts
name: consul-agent-scripts-config
- mountPath: /consul/certs
name: consul-agent-certs-config
resources: {{ include "common.resources" . | nindent 10 }}
volumes:
+ - name: consul-agent-config-dir
+ emptyDir: {}
- configMap:
name: {{ include "common.fullname" . }}-configmap
name: consul-agent-config