From bc6a6674f749efc1693c4b6bd58a27f8c37a0ae0 Mon Sep 17 00:00:00 2001 From: Krzysztof Opasiak Date: Mon, 23 Nov 2020 22:02:51 +0100 Subject: [MSB] Make consul run as non-root Start whole consul container as non-root and ensure that both dumb-init and consul are able to start and run as non-root. Issue-ID: REQ-362 Change-Id: If5a737953122cc6cd22b8d43ac603b40f4b22727 Signed-off-by: Krzysztof Opasiak --- .../msb/charts/msb-consul/templates/deployment.yaml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'kubernetes/msb/charts/msb-consul/templates/deployment.yaml') diff --git a/kubernetes/msb/charts/msb-consul/templates/deployment.yaml b/kubernetes/msb/charts/msb-consul/templates/deployment.yaml index 2639a8ed36..c7472cca72 100644 --- a/kubernetes/msb/charts/msb-consul/templates/deployment.yaml +++ b/kubernetes/msb/charts/msb-consul/templates/deployment.yaml @@ -41,6 +41,16 @@ spec: - name: {{ include "common.name" . }} image: "{{ .Values.global.dockerHubRepository | default .Values.dockerHubRepository }}/{{ .Values.image }}" imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} + command: + - docker-entrypoint.sh + args: + - "agent" + - "-dev" + - "-client" + - "0.0.0.0" ports: - containerPort: {{ .Values.service.internalPort }} # disable liveness probe when breakpoints set in debugger @@ -62,6 +72,9 @@ spec: - mountPath: /etc/localtime name: localtime readOnly: true + - mountPath: /usr/local/bin/docker-entrypoint.sh + name: entrypoint + subPath: docker-entrypoint.sh resources: {{ include "common.resources" . | indent 12 }} {{- if .Values.nodeSelector }} @@ -76,5 +89,9 @@ spec: - name: localtime hostPath: path: /etc/localtime + - name: entrypoint + configMap: + name: {{ include "common.fullname" . }}-entrypoint + defaultMode: 0777 imagePullSecrets: - name: "{{ include "common.namespace" . }}-docker-registry-key" -- cgit 1.2.3-korg