Merge "[DMAAP] Add pod security context to MR and others"

7 files changed, 35 insertions, 0 deletions

diff --git a/kubernetes/common/certInitializer/templates/_certInitializer.yaml b/kubernetes/common/certInitializer/templates/_certInitializer.yaml
index b1e85c00cc..1312d98009 100644
--- a/kubernetes/common/certInitializer/templates/_certInitializer.yaml
+++ b/kubernetes/common/certInitializer/templates/_certInitializer.yaml
@@ -47,6 +47,8 @@
 - name: {{ include "common.name" $dot }}-aaf-config
   image: {{ include "repositoryGenerator.repository" $subchartDot }}/{{ $subchartDot.Values.global.aafAgentImage }}
   imagePullPolicy: {{ $subchartDot.Values.global.pullPolicy | default $subchartDot.Values.pullPolicy }}
+  securityContext:
+    runAsUser: 0
   volumeMounts:
   - mountPath: {{ $initRoot.mountPath }}
     name: {{ include "common.certInitializer._aafConfigVolumeName" $dot }}
diff --git a/kubernetes/dmaap/components/dmaap-bc/templates/deployment.yaml b/kubernetes/dmaap/components/dmaap-bc/templates/deployment.yaml
index a0b6fdad8d..c9b6800ffd 100644
--- a/kubernetes/dmaap/components/dmaap-bc/templates/deployment.yaml
+++ b/kubernetes/dmaap/components/dmaap-bc/templates/deployment.yaml
@@ -23,6 +23,7 @@ spec:
   template:
     metadata: {{- include "common.templateMetadata" . | nindent 6 }}
     spec:
+      {{ include "common.podSecurityContext" . | indent 6 | trim}}
 {{- if or .Values.global.aafEnabled .Values.PG.enabled }}
       initContainers:
       - command:
@@ -45,6 +46,8 @@ spec:
         name: {{ include "common.name" . }}-update-config
 {{ include "common.certInitializer.initContainer" . | nindent 6 }}
       - name: {{ include "common.name" . }}-permission-fixer
+        securityContext:
+          runAsUser: 0
         image: {{ include "repositoryGenerator.image.busybox" . }}
         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
         volumeMounts: {{ include "common.certInitializer.volumeMount" . | nindent 8 }}
@@ -60,6 +63,9 @@ spec:
         command: ["/bin/sh"]
         args: [ "-c", "sed -i -e '/cadi_keystore_password=/d' -e '/cadi_keystore_password_jks/p' -e 's/cadi_keystore_password_jks/cadi_keystore_password/' -e 's/dmaap-bc.p12/dmaap-bc.jks/' /opt/app/osaaf/local/org.onap.dmaap-bc.cred.props" ]
       - name: {{ include "common.name" . }}-postgres-readiness
+        securityContext:
+          runAsUser: 100
+          runAsGroup: 65533
         command:
         - /app/ready.py
         args:
diff --git a/kubernetes/dmaap/components/dmaap-bc/values.yaml b/kubernetes/dmaap/components/dmaap-bc/values.yaml
index a8e7cf91c7..cc860823f9 100644
--- a/kubernetes/dmaap/components/dmaap-bc/values.yaml
+++ b/kubernetes/dmaap/components/dmaap-bc/values.yaml
@@ -146,6 +146,11 @@ ingress:
 
 # Resource Limit flavor -By Default using small
 flavor: small
+
+securityContext:
+  user_id: 1000
+  group_id: 101
+
 # Segregation for Different environment (Small and Large)
 resources:
   small:
diff --git a/kubernetes/dmaap/components/dmaap-dr-node/templates/statefulset.yaml b/kubernetes/dmaap/components/dmaap-dr-node/templates/statefulset.yaml
index 2bfa496bcd..69f6fc1d6e 100644
--- a/kubernetes/dmaap/components/dmaap-dr-node/templates/statefulset.yaml
+++ b/kubernetes/dmaap/components/dmaap-dr-node/templates/statefulset.yaml
@@ -23,8 +23,12 @@ spec:
   template:
     metadata: {{- include "common.templateMetadata" . | nindent 6 }}
     spec:
+      {{ include "common.podSecurityContext" . | indent 6 | trim}}
       initContainers: {{ include "common.certInitializer.initContainer" . | nindent 8 }}
         - name: {{ include "common.name" . }}-readiness
+          securityContext:
+            runAsUser: 100
+            runAsGroup: 65533
           image: {{ include "repositoryGenerator.image.readiness" . }}
           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
           command:
@@ -39,6 +43,8 @@ spec:
                 apiVersion: v1
                 fieldPath: metadata.namespace
         - name: {{ include "common.name" . }}-permission-fixer
+          securityContext:
+            runAsUser: 0
           image: {{ include "repositoryGenerator.image.busybox" . }}
           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
           volumeMounts: {{ include "common.certInitializer.volumeMount" . | nindent 10 }}
diff --git a/kubernetes/dmaap/components/dmaap-dr-node/values.yaml b/kubernetes/dmaap/components/dmaap-dr-node/values.yaml
index e34bc0068d..6ad3e454d7 100644
--- a/kubernetes/dmaap/components/dmaap-dr-node/values.yaml
+++ b/kubernetes/dmaap/components/dmaap-dr-node/values.yaml
@@ -113,6 +113,11 @@ ingress:
 
 # Resource Limit flavor -By Default using small
 flavor: small
+
+securityContext:
+  user_id: 1000
+  group_id: 1000
+
 # Segregation for Different environment (Small and Large)
 resources:
   small:
diff --git a/kubernetes/dmaap/components/dmaap-dr-prov/templates/deployment.yaml b/kubernetes/dmaap/components/dmaap-dr-prov/templates/deployment.yaml
index b7acbc9d8d..325ca9f2a7 100644
--- a/kubernetes/dmaap/components/dmaap-dr-prov/templates/deployment.yaml
+++ b/kubernetes/dmaap/components/dmaap-dr-prov/templates/deployment.yaml
@@ -34,9 +34,13 @@ spec:
         app: {{ include "common.name" . }}
         release: {{ include "common.release" . }}
     spec:
+      {{ include "common.podSecurityContext" . | indent 6 | trim}}
       hostname: {{ .Values.global.dmaapDrProvName }}
       initContainers:
         - name: {{ include "common.name" . }}-readiness
+          securityContext:
+            runAsUser: 100
+            runAsGroup: 65533
           image: {{ include "repositoryGenerator.image.readiness" . }}
           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
           command:
@@ -55,6 +59,8 @@ spec:
         {{ include "common.certInitializer.initContainer" . | nindent 8 }}
 
         - name: {{ include "common.name" . }}-permission-fixer
+          securityContext:
+            runAsUser: 0
           image: {{ include "repositoryGenerator.image.busybox" . }}
           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
           volumeMounts: {{ include "common.certInitializer.volumeMount" . | nindent 10 }}
diff --git a/kubernetes/dmaap/components/dmaap-dr-prov/values.yaml b/kubernetes/dmaap/components/dmaap-dr-prov/values.yaml
index 1d9432afa2..9e6effac8b 100644
--- a/kubernetes/dmaap/components/dmaap-dr-prov/values.yaml
+++ b/kubernetes/dmaap/components/dmaap-dr-prov/values.yaml
@@ -142,6 +142,11 @@ certInitializer:
 
 # Resource Limit flavor -By Default using small
 flavor: small
+
+securityContext:
+  user_id: 1000
+  group_id: 1000
+
 # Segregation for Different environment (Small and Large)
 resources:
   small: