summaryrefslogtreecommitdiffstats
path: root/ansible/roles
diff options
context:
space:
mode:
Diffstat (limited to 'ansible/roles')
-rw-r--r--ansible/roles/rke/templates/kubernetes-dashboard.yaml.j221
1 files changed, 18 insertions, 3 deletions
diff --git a/ansible/roles/rke/templates/kubernetes-dashboard.yaml.j2 b/ansible/roles/rke/templates/kubernetes-dashboard.yaml.j2
index 7dd9692c..aca2dad8 100644
--- a/ansible/roles/rke/templates/kubernetes-dashboard.yaml.j2
+++ b/ansible/roles/rke/templates/kubernetes-dashboard.yaml.j2
@@ -162,7 +162,6 @@ apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: kubernetes-dashboard
- namespace: kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
@@ -194,7 +193,7 @@ spec:
spec:
containers:
- name: kubernetes-dashboard
- image: kubernetesui/dashboard:v2.0.0-beta4
+ image: kubernetesui/dashboard:v2.0.5
imagePullPolicy: Always
ports:
- containerPort: 8443
@@ -219,6 +218,11 @@ spec:
port: 8443
initialDelaySeconds: 30
timeoutSeconds: 30
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsUser: 1001
+ runAsGroup: 2001
volumes:
- name: kubernetes-dashboard-certs
secret:
@@ -226,6 +230,8 @@ spec:
- name: tmp-volume
emptyDir: {}
serviceAccountName: kubernetes-dashboard
+ nodeSelector:
+ "kubernetes.io/os": linux
# Comment the following tolerations if Dashboard must not be deployed on master
tolerations:
- key: node-role.kubernetes.io/master
@@ -266,10 +272,12 @@ spec:
metadata:
labels:
k8s-app: dashboard-metrics-scraper
+ annotations:
+ seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
spec:
containers:
- name: dashboard-metrics-scraper
- image: kubernetesui/metrics-scraper:v1.0.1
+ image: kubernetesui/metrics-scraper:v1.0.6
ports:
- containerPort: 8000
protocol: TCP
@@ -283,7 +291,14 @@ spec:
volumeMounts:
- mountPath: /tmp
name: tmp-volume
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsUser: 1001
+ runAsGroup: 2001
serviceAccountName: kubernetes-dashboard
+ nodeSelector:
+ "kubernetes.io/os": linux
# Comment the following tolerations if Dashboard must not be deployed on master
tolerations:
- key: node-role.kubernetes.io/master