From 775b166148ff8f4abb2e667a9824a66f5bd674c0 Mon Sep 17 00:00:00 2001
From: Krzysztof Opasiak <k.opasiak@samsung.com>
Date: Wed, 25 Nov 2020 16:54:36 +0100
Subject: [CONSUL] Make consul run as non-root

Use our recently build consul image (still based on the same old
consul version) and modify the deployment to make sure that it is able
to run as non-root user.

Yes, I know that moving consul-server to component would be more
proper solution but as this commit is supposed to be cherry-picked to
guilin I've tried to make as little changes as possible.

Issue-ID: REQ-362
Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
Change-Id: Idfc09ee225d4f89bb699683fa5e4ae3b86491c08
---
 .../consul/charts/consul-server/templates/statefulset.yaml       | 3 +++
 kubernetes/consul/charts/consul-server/values.yaml               | 9 +++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

(limited to 'kubernetes/consul/charts')

diff --git a/kubernetes/consul/charts/consul-server/templates/statefulset.yaml b/kubernetes/consul/charts/consul-server/templates/statefulset.yaml
index 430b6dd1bd..872ef13f95 100644
--- a/kubernetes/consul/charts/consul-server/templates/statefulset.yaml
+++ b/kubernetes/consul/charts/consul-server/templates/statefulset.yaml
@@ -42,6 +42,9 @@ spec:
       containers:
       - name: {{ include "common.name" . }}
         image: "{{ include "common.repository" . }}/{{ .Values.image }}"
+        securityContext:
+          runAsUser: {{ .Values.securityContext.runAsUser }}
+          runAsGroup: {{ .Values.securityContext.runAsGroup }}
         command: ["/usr/local/bin/docker-entrypoint.sh"]
         args:
         - "agent"
diff --git a/kubernetes/consul/charts/consul-server/values.yaml b/kubernetes/consul/charts/consul-server/values.yaml
index 81472e71eb..d4c03e54ca 100644
--- a/kubernetes/consul/charts/consul-server/values.yaml
+++ b/kubernetes/consul/charts/consul-server/values.yaml
@@ -25,8 +25,8 @@ global:
 # Application configuration defaults.
 #################################################################
 # application image
-repository: docker.io
-image: consul:1.0.6
+repository: nexus3.onap.org:10001
+image: onap/oom/consul:2.1.0
 pullPolicy: Always
 
 # flag to enable debugging - application support required
@@ -90,3 +90,8 @@ resources:
       cpu: 1
       memory: 2Gi
   unlimited: {}
+
+securityContext:
+  fsGroup: 1000
+  runAsUser: 100
+  runAsGroup: 1000
-- 
cgit 1.2.3-korg