diff options
Diffstat (limited to 'ansible/roles')
| -rw-r--r-- | ansible/roles/rke/templates/kubernetes-dashboard.yaml.j2 | 21 |
1 files changed, 18 insertions, 3 deletions
diff --git a/ansible/roles/rke/templates/kubernetes-dashboard.yaml.j2 b/ansible/roles/rke/templates/kubernetes-dashboard.yaml.j2 index 7dd9692c..aca2dad8 100644 --- a/ansible/roles/rke/templates/kubernetes-dashboard.yaml.j2 +++ b/ansible/roles/rke/templates/kubernetes-dashboard.yaml.j2 @@ -162,7 +162,6 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: kubernetes-dashboard - namespace: kubernetes-dashboard roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -194,7 +193,7 @@ spec: spec: containers: - name: kubernetes-dashboard - image: kubernetesui/dashboard:v2.0.0-beta4 + image: kubernetesui/dashboard:v2.0.5 imagePullPolicy: Always ports: - containerPort: 8443 @@ -219,6 +218,11 @@ spec: port: 8443 initialDelaySeconds: 30 timeoutSeconds: 30 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsUser: 1001 + runAsGroup: 2001 volumes: - name: kubernetes-dashboard-certs secret: @@ -226,6 +230,8 @@ spec: - name: tmp-volume emptyDir: {} serviceAccountName: kubernetes-dashboard + nodeSelector: + "kubernetes.io/os": linux # Comment the following tolerations if Dashboard must not be deployed on master tolerations: - key: node-role.kubernetes.io/master @@ -266,10 +272,12 @@ spec: metadata: labels: k8s-app: dashboard-metrics-scraper + annotations: + seccomp.security.alpha.kubernetes.io/pod: 'runtime/default' spec: containers: - name: dashboard-metrics-scraper - image: kubernetesui/metrics-scraper:v1.0.1 + image: kubernetesui/metrics-scraper:v1.0.6 ports: - containerPort: 8000 protocol: TCP @@ -283,7 +291,14 @@ spec: volumeMounts: - mountPath: /tmp name: tmp-volume + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsUser: 1001 + runAsGroup: 2001 serviceAccountName: kubernetes-dashboard + nodeSelector: + "kubernetes.io/os": linux # Comment the following tolerations if Dashboard must not be deployed on master tolerations: - key: node-role.kubernetes.io/master |