Merge branch 'nightly' into k8s-shuffle-app-ports

functions/kubernetes/charts/shuffle/values.yaml

@@ -310,14 +310,14 @@ backend:
   ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
   ##
   tolerations: []
-  ## ONLY FOR DEPLOYMENTS:
   ## @param backend.updateStrategy.type backend deployment strategy type
   ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
   ##
   updateStrategy:
     ## Can be set to RollingUpdate or Recreate
+    ## Backend uses ReadWriteOnce volumes by default, which is incompatible with RollingUpdate
     ##
-    type: RollingUpdate
+    type: Recreate 
   ## @param backend.priorityClassName backend pods' priorityClassName
   ##
   priorityClassName: ""
@@ -421,6 +421,14 @@ backend:
       targetCPU: ""
       targetMemory: ""
 
+  ## Service configuration
+  ##
+  service:
+    ## @param backend.service.labels Extra labels for backend service
+    ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+    ##
+    labels: {}
+
   ## ServiceAccount configuration
   ##
   serviceAccount:
@@ -870,6 +878,14 @@ frontend:
       targetCPU: ""
       targetMemory: ""
 
+  ## Service configuration
+  ##
+  service:
+    ## @param frontend.service.labels Extra labels for frontend service
+    ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+    ##
+    labels: {}
+
   ## ServiceAccount configuration
   ##
   serviceAccount:
@@ -1328,6 +1344,48 @@ worker:
     tag: ""
     digest: ""
 
+  ## Configure Pods Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
+  ## @param worker.podSecurityContext.enabled Enable worker pods' Security Context
+  ## @param worker.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for worker pods
+  ## @param worker.podSecurityContext.sysctls Set kernel settings using the sysctl interface for worker pods
+  ## @param worker.podSecurityContext.supplementalGroups Set filesystem extra groups for worker pods
+  ## @param worker.podSecurityContext.fsGroup Set fsGroup in worker pods' Security Context
+  ##
+  podSecurityContext:
+    enabled: true
+    fsGroupChangePolicy: Always
+    sysctls: []
+    supplementalGroups: []
+    fsGroup: 1001
+    
+  ## Configure Container Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
+  ## @param worker.containerSecurityContext.enabled Enabled worker container' Security Context
+  ## @param worker.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in worker container
+  ## @param worker.containerSecurityContext.runAsUser Set runAsUser in worker container' Security Context
+  ## @param worker.containerSecurityContext.runAsGroup Set runAsGroup in worker container' Security Context
+  ## @param worker.containerSecurityContext.runAsNonRoot Set runAsNonRoot in worker container' Security Context
+  ## @param worker.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in worker container' Security Context
+  ## @param worker.containerSecurityContext.privileged Set privileged in worker container' Security Context
+  ## @param worker.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in worker container' Security Context
+  ## @param worker.containerSecurityContext.capabilities.drop List of capabilities to be dropped in worker container
+  ## @param worker.containerSecurityContext.seccompProfile.type Set seccomp profile in worker container
+  ##
+  containerSecurityContext:
+    enabled: true
+    seLinuxOptions: {}
+    runAsUser: 1001
+    runAsGroup: 1001
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    privileged: false
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+    seccompProfile:
+      type: "RuntimeDefault"
+
   ## ServiceAccount configuration
   ##
   serviceAccount:
@@ -1390,6 +1448,48 @@ worker:
 ## @section app Parameters
 ##
 app:
+  ## Configure Pods Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
+  ## @param app.podSecurityContext.enabled Enable app pods' Security Context
+  ## @param app.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for app pods
+  ## @param app.podSecurityContext.sysctls Set kernel settings using the sysctl interface for app pods
+  ## @param app.podSecurityContext.supplementalGroups Set filesystem extra groups for app pods
+  ## @param app.podSecurityContext.fsGroup Set fsGroup in app pods' Security Context
+  ##
+  podSecurityContext:
+    enabled: true
+    fsGroupChangePolicy: Always
+    sysctls: []
+    supplementalGroups: []
+    fsGroup: 1001
+    
+  ## Configure Container Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
+  ## @param app.containerSecurityContext.enabled Enabled app container' Security Context
+  ## @param app.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in app container
+  ## @param app.containerSecurityContext.runAsUser Set runAsUser in app container' Security Context
+  ## @param app.containerSecurityContext.runAsGroup Set runAsGroup in app container' Security Context
+  ## @param app.containerSecurityContext.runAsNonRoot Set runAsNonRoot in app container' Security Context
+  ## @param app.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in app container' Security Context
+  ## @param app.containerSecurityContext.privileged Set privileged in app container' Security Context
+  ## @param app.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in app container' Security Context
+  ## @param app.containerSecurityContext.capabilities.drop List of capabilities to be dropped in app container
+  ## @param app.containerSecurityContext.seccompProfile.type Set seccomp profile in app container
+  ##
+  containerSecurityContext:
+    enabled: true
+    seLinuxOptions: {}
+    runAsUser: 1001
+    runAsGroup: 1001
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    privileged: false
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+    seccompProfile:
+      type: "RuntimeDefault"
+      
   ## ServiceAccount configuration
   ##
   serviceAccount: