From 3de18af3a398f9d4cb4aea2e081ba6b2e8c048d6 Mon Sep 17 00:00:00 2001
From: Serge Logvinov <serge.logvinov@sinextra.dev>
Date: Thu, 6 Apr 2023 12:18:44 +0300
Subject: [PATCH] Add pod annotation, securityContext blocks
Signed-off-by: Serge Logvinov <serge.logvinov@sinextra.dev>
(cherry picked from commit 4d42c70e748fed13cd66f86656e909184a5b08d2)
---
.../templates/deployment.yaml | 8 ++++++++
deploy/chart/local-path-provisioner/values.yaml | 15 +++++++++++++++
2 files changed, 23 insertions(+)
diff --git a/deploy/chart/local-path-provisioner/templates/deployment.yaml b/deploy/chart/local-path-provisioner/templates/deployment.yaml
index 1e011743..e07b1647 100644
--- a/deploy/chart/local-path-provisioner/templates/deployment.yaml
+++ b/deploy/chart/local-path-provisioner/templates/deployment.yaml
@@ -13,6 +13,10 @@ spec:
app.kubernetes.io/instance: {{ .Release.Name }}
template:
metadata:
+ {{- with .Values.podAnnotations }}
+ annotations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
labels:
app.kubernetes.io/name: {{ include "local-path-provisioner.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
@@ -22,8 +26,12 @@ spec:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ template "local-path-provisioner.serviceAccountName" . }}
+ securityContext:
+ {{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}
+ securityContext:
+ {{- toYaml .Values.securityContext | nindent 12 }}
{{- if .Values.privateRegistry.registryUrl }}
image: "{{ .Values.privateRegistry.registryUrl }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"
{{- else }}
diff --git a/deploy/chart/local-path-provisioner/values.yaml b/deploy/chart/local-path-provisioner/values.yaml
index 61b6fe82..96550935 100644
--- a/deploy/chart/local-path-provisioner/values.yaml
+++ b/deploy/chart/local-path-provisioner/values.yaml
@@ -69,6 +69,21 @@ nodePathMap:
# If `sharedFileSystemPath` is used, then `nodePathMap` must be set to `[]`.
# sharedFileSystemPath: ""
+podAnnotations: {}
+
+podSecurityContext: {}
+ # runAsNonRoot: true
+
+securityContext: {}
+ # allowPrivilegeEscalation: false
+ # seccompProfile:
+ # type: RuntimeDefault
+ # capabilities:
+ # drop: ["ALL"]
+ # runAsUser: 65534
+ # runAsGroup: 65534
+ # readOnlyRootFilesystem: true
+
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
--
GitLab