diff options
| author |   Krzysztof Opasiak <k.opasiak@samsung.com> | 2020-11-23 22:02:51 +0100 |
|---|---|---|
| committer | Krzysztof Opasiak <k.opasiak@samsung.com> | 2020-11-25 15:45:12 +0000 |
| commit | 4c4205834827a78e975f97dd624ac77d7e68510e (patch) | |
| tree | 3ca9333f14fd4e3490b66853605f257f24a49a09 /kubernetes/msb/charts/msb-consul/templates/deployment.yaml | |
| parent | 6574b647a5838435b3688af82709507deb5724b5 (diff) | |
[MSB] Make consul run as non-root
Start whole consul container as non-root and ensure that both
dumb-init and consul are able to start and run as non-root.
Issue-ID: REQ-362
Change-Id: If5a737953122cc6cd22b8d43ac603b40f4b22727
Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
(cherry picked from commit bc6a6674f749efc1693c4b6bd58a27f8c37a0ae0)
Diffstat (limited to 'kubernetes/msb/charts/msb-consul/templates/deployment.yaml')
| -rw-r--r-- | kubernetes/msb/charts/msb-consul/templates/deployment.yaml | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/kubernetes/msb/charts/msb-consul/templates/deployment.yaml b/kubernetes/msb/charts/msb-consul/templates/deployment.yaml index 2639a8ed36..c7472cca72 100644 --- a/kubernetes/msb/charts/msb-consul/templates/deployment.yaml +++ b/kubernetes/msb/charts/msb-consul/templates/deployment.yaml @@ -41,6 +41,16 @@ spec: - name: {{ include "common.name" . }} image: "{{ .Values.global.dockerHubRepository | default .Values.dockerHubRepository }}/{{ .Values.image }}" imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} + command: + - docker-entrypoint.sh + args: + - "agent" + - "-dev" + - "-client" + - "0.0.0.0" ports: - containerPort: {{ .Values.service.internalPort }} # disable liveness probe when breakpoints set in debugger @@ -62,6 +72,9 @@ spec: - mountPath: /etc/localtime name: localtime readOnly: true + - mountPath: /usr/local/bin/docker-entrypoint.sh + name: entrypoint + subPath: docker-entrypoint.sh resources: {{ include "common.resources" . | indent 12 }} {{- if .Values.nodeSelector }} @@ -76,5 +89,9 @@ spec: - name: localtime hostPath: path: /etc/localtime + - name: entrypoint + configMap: + name: {{ include "common.fullname" . }}-entrypoint + defaultMode: 0777 imagePullSecrets: - name: "{{ include "common.namespace" . }}-docker-registry-key" |