Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable security context by default (#2644)

Browse Source 
We enable security context by default now, so that the fission pod do not have root access to the system.

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
This commit is contained in:
Sanket Sudake
2022-11-29 10:44:30 +05:30
committed by GitHub
parent 8a3d8a4762
commit 0aec9e139e
2 changed files with 9 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/fission-all/values.yaml
+9 -9
View File
@@ -166,7 +166,7 @@ executor:
## This is an experimental section, please verify before enabling in production. ## This is an experimental section, please verify before enabling in production.
## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
securityContext: securityContext:
enabled: false enabled: true
## Mark it false, if you want to stop the non root user validation ## Mark it false, if you want to stop the non root user validation
runAsNonRoot: true runAsNonRoot: true
fsGroup: 10001 fsGroup: 10001
@@ -303,7 +303,7 @@ router:
## This is an experimental section, please verify before enabling in production. ## This is an experimental section, please verify before enabling in production.
## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
securityContext: securityContext:
enabled: false enabled: true
## Mark it false, if you want to stop the non root user validation ## Mark it false, if you want to stop the non root user validation
runAsNonRoot: true runAsNonRoot: true
fsGroup: 10001 fsGroup: 10001
@@ -329,7 +329,7 @@ buildermgr:
## This is an experimental section, please verify before enabling in production. ## This is an experimental section, please verify before enabling in production.
## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
securityContext: securityContext:
enabled: false enabled: true
## Mark it false, if you want to stop the non root user validation ## Mark it false, if you want to stop the non root user validation
runAsNonRoot: true runAsNonRoot: true
fsGroup: 10001 fsGroup: 10001
@@ -357,7 +357,7 @@ controller:
## This is an experimental section, please verify before enabling in production. ## This is an experimental section, please verify before enabling in production.
## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
securityContext: securityContext:
enabled: false enabled: true
## Mark it false, if you want to stop the non root user validation ## Mark it false, if you want to stop the non root user validation
runAsNonRoot: true runAsNonRoot: true
fsGroup: 10001 fsGroup: 10001
@@ -394,7 +394,7 @@ webhook:
## This is an experimental section, please verify before enabling in production. ## This is an experimental section, please verify before enabling in production.
## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
securityContext: securityContext:
enabled: false enabled: true
## Mark it false, if you want to stop the non root user validation ## Mark it false, if you want to stop the non root user validation
runAsNonRoot: true runAsNonRoot: true
fsGroup: 10001 fsGroup: 10001
@@ -421,7 +421,7 @@ kubewatcher:
## This is an experimental section, please verify before enabling in production. ## This is an experimental section, please verify before enabling in production.
## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
securityContext: securityContext:
enabled: false enabled: true
## Mark it false, if you want to stop the non root user validation ## Mark it false, if you want to stop the non root user validation
runAsNonRoot: true runAsNonRoot: true
fsGroup: 10001 fsGroup: 10001
@@ -453,7 +453,7 @@ storagesvc:
## This is an experimental section, please verify before enabling in production. ## This is an experimental section, please verify before enabling in production.
## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
securityContext: securityContext:
enabled: false enabled: true
## Mark it false, if you want to stop the non root user validation ## Mark it false, if you want to stop the non root user validation
runAsNonRoot: true runAsNonRoot: true
fsGroup: 10001 fsGroup: 10001
@@ -480,7 +480,7 @@ timer:
## This is an experimental section, please verify before enabling in production. ## This is an experimental section, please verify before enabling in production.
## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
securityContext: securityContext:
enabled: false enabled: true
## Mark it false, if you want to stop the non root user validation ## Mark it false, if you want to stop the non root user validation
runAsNonRoot: true runAsNonRoot: true
fsGroup: 10001 fsGroup: 10001
@@ -725,7 +725,7 @@ canaryDeployment:
## This is an experimental section, please verify before enabling in production. ## This is an experimental section, please verify before enabling in production.
## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1 ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
securityContext: securityContext:
enabled: false enabled: true
## Mark it false, if you want to stop the non root user validation ## Mark it false, if you want to stop the non root user validation
runAsNonRoot: true runAsNonRoot: true
fsGroup: 10001 fsGroup: 10001
skaffold.yaml
-7
View File
@@ -58,13 +58,6 @@ deploy:
# Use /var/log directory for kind logs export # Use /var/log directory for kind logs export
terminationMessagePath: /var/log/termination-log terminationMessagePath: /var/log/termination-log
terminationMessagePolicy: FallbackToLogsOnError terminationMessagePolicy: FallbackToLogsOnError
executor.securityContext.enabled: true
router.securityContext.enabled: true
buildermgr.securityContext.enabled: true
controller.securityContext.enabled: true
kubewatcher.securityContext.enabled: true
webhook.securityContext.enabled: true
storagesvc.securityContext.enabled: true
controller.enabled: false controller.enabled: false
serviceMonitor.enabled: false serviceMonitor.enabled: false
serviceMonitor.namespace: monitoring serviceMonitor.namespace: monitoring