feat(k8s): allow to set security contexts for worker and apps
Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>
This commit is contained in:
Pascal Sthamer
@@ -2074,6 +2074,103 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"podSecurityContext": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"description": "Enable worker pods' Security Context",
|
||||
"default": true
|
||||
},
|
||||
"fsGroupChangePolicy": {
|
||||
"type": "string",
|
||||
"description": "Set filesystem group change policy for worker pods",
|
||||
"default": "Always"
|
||||
},
|
||||
"sysctls": {
|
||||
"type": "array",
|
||||
"description": "Set kernel settings using the sysctl interface for worker pods",
|
||||
"default": [],
|
||||
"items": {}
|
||||
},
|
||||
"supplementalGroups": {
|
||||
"type": "array",
|
||||
"description": "Set filesystem extra groups for worker pods",
|
||||
"default": [],
|
||||
"items": {}
|
||||
},
|
||||
"fsGroup": {
|
||||
"type": "number",
|
||||
"description": "Set fsGroup in worker pods' Security Context",
|
||||
"default": 1001
|
||||
}
|
||||
}
|
||||
},
|
||||
"containerSecurityContext": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"description": "Enabled worker container' Security Context",
|
||||
"default": true
|
||||
},
|
||||
"runAsUser": {
|
||||
"type": "number",
|
||||
"description": "Set runAsUser in worker container' Security Context",
|
||||
"default": 1001
|
||||
},
|
||||
"runAsGroup": {
|
||||
"type": "number",
|
||||
"description": "Set runAsGroup in worker container' Security Context",
|
||||
"default": 1001
|
||||
},
|
||||
"runAsNonRoot": {
|
||||
"type": "boolean",
|
||||
"description": "Set runAsNonRoot in worker container' Security Context",
|
||||
"default": true
|
||||
},
|
||||
"readOnlyRootFilesystem": {
|
||||
"type": "boolean",
|
||||
"description": "Set readOnlyRootFilesystem in worker container' Security Context",
|
||||
"default": true
|
||||
},
|
||||
"privileged": {
|
||||
"type": "boolean",
|
||||
"description": "Set privileged in worker container' Security Context",
|
||||
"default": false
|
||||
},
|
||||
"allowPrivilegeEscalation": {
|
||||
"type": "boolean",
|
||||
"description": "Set allowPrivilegeEscalation in worker container' Security Context",
|
||||
"default": false
|
||||
},
|
||||
"capabilities": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"drop": {
|
||||
"type": "array",
|
||||
"description": "List of capabilities to be dropped in worker container",
|
||||
"default": [
|
||||
"ALL"
|
||||
],
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"seccompProfile": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string",
|
||||
"description": "Set seccomp profile in worker container",
|
||||
"default": "RuntimeDefault"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"serviceAccount": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
@@ -2152,6 +2249,103 @@
|
||||
"app": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"podSecurityContext": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"description": "Enable app pods' Security Context",
|
||||
"default": true
|
||||
},
|
||||
"fsGroupChangePolicy": {
|
||||
"type": "string",
|
||||
"description": "Set filesystem group change policy for app pods",
|
||||
"default": "Always"
|
||||
},
|
||||
"sysctls": {
|
||||
"type": "array",
|
||||
"description": "Set kernel settings using the sysctl interface for app pods",
|
||||
"default": [],
|
||||
"items": {}
|
||||
},
|
||||
"supplementalGroups": {
|
||||
"type": "array",
|
||||
"description": "Set filesystem extra groups for app pods",
|
||||
"default": [],
|
||||
"items": {}
|
||||
},
|
||||
"fsGroup": {
|
||||
"type": "number",
|
||||
"description": "Set fsGroup in app pods' Security Context",
|
||||
"default": 1001
|
||||
}
|
||||
}
|
||||
},
|
||||
"containerSecurityContext": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"description": "Enabled app container' Security Context",
|
||||
"default": true
|
||||
},
|
||||
"runAsUser": {
|
||||
"type": "number",
|
||||
"description": "Set runAsUser in app container' Security Context",
|
||||
"default": 1001
|
||||
},
|
||||
"runAsGroup": {
|
||||
"type": "number",
|
||||
"description": "Set runAsGroup in app container' Security Context",
|
||||
"default": 1001
|
||||
},
|
||||
"runAsNonRoot": {
|
||||
"type": "boolean",
|
||||
"description": "Set runAsNonRoot in app container' Security Context",
|
||||
"default": true
|
||||
},
|
||||
"readOnlyRootFilesystem": {
|
||||
"type": "boolean",
|
||||
"description": "Set readOnlyRootFilesystem in app container' Security Context",
|
||||
"default": true
|
||||
},
|
||||
"privileged": {
|
||||
"type": "boolean",
|
||||
"description": "Set privileged in app container' Security Context",
|
||||
"default": false
|
||||
},
|
||||
"allowPrivilegeEscalation": {
|
||||
"type": "boolean",
|
||||
"description": "Set allowPrivilegeEscalation in app container' Security Context",
|
||||
"default": false
|
||||
},
|
||||
"capabilities": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"drop": {
|
||||
"type": "array",
|
||||
"description": "List of capabilities to be dropped in app container",
|
||||
"default": [
|
||||
"ALL"
|
||||
],
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"seccompProfile": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string",
|
||||
"description": "Set seccomp profile in app container",
|
||||
"default": "RuntimeDefault"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"serviceAccount": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
|
||||
Reference in New Issue
Block a user