Merge "Enabling Apparmor for drydock init and test containers"
This commit is contained in:
commit
e0d804ed31
|
@ -37,7 +37,7 @@ spec:
|
||||||
{{ $labels | indent 8 }}
|
{{ $labels | indent 8 }}
|
||||||
annotations:
|
annotations:
|
||||||
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
|
||||||
{{ dict "envAll" $envAll "podName" "drydock-api" "containerNames" (list "drydock-api") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
|
{{ dict "envAll" $envAll "podName" "drydock-api" "containerNames" (list "init" "drydock-api") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
|
||||||
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
|
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
|
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
spec:
|
spec:
|
||||||
|
|
|
@ -29,6 +29,11 @@ spec:
|
||||||
template:
|
template:
|
||||||
metadata:
|
metadata:
|
||||||
labels:
|
labels:
|
||||||
|
annotations:
|
||||||
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
|
||||||
|
{{ dict "envAll" $envAll "podName" "drydock-db-init" "containerNames" (list "init" "drydock-db-init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
|
||||||
|
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
|
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
{{ tuple $envAll "drydock" "db-init" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
|
{{ tuple $envAll "drydock" "db-init" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
|
||||||
spec:
|
spec:
|
||||||
serviceAccountName: {{ $serviceAccountName }}
|
serviceAccountName: {{ $serviceAccountName }}
|
||||||
|
|
|
@ -29,6 +29,11 @@ spec:
|
||||||
template:
|
template:
|
||||||
metadata:
|
metadata:
|
||||||
labels:
|
labels:
|
||||||
|
annotations:
|
||||||
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
|
||||||
|
{{ dict "envAll" $envAll "podName" "drydock-db-sync" "containerNames" (list "init" "drydock-db-sync") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
|
||||||
|
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
|
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
{{ tuple $envAll "drydock" "db-sync" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
|
{{ tuple $envAll "drydock" "db-sync" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
|
||||||
spec:
|
spec:
|
||||||
serviceAccountName: {{ $serviceAccountName }}
|
serviceAccountName: {{ $serviceAccountName }}
|
||||||
|
|
|
@ -21,10 +21,11 @@ Test that the API is up and the health endpoint returns a 2XX code */}}
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Pod
|
kind: Pod
|
||||||
metadata:
|
metadata:
|
||||||
name: "{{ .Release.Name }}-api-test"
|
name: drydock-api-test
|
||||||
annotations:
|
annotations:
|
||||||
"helm.sh/hook": "test-success"
|
"helm.sh/hook": "test-success"
|
||||||
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
|
||||||
|
{{ dict "envAll" $envAll "podName" "drydock-api-test" "containerNames" (list "drydock-api-test") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 4 }}
|
||||||
labels:
|
labels:
|
||||||
{{ tuple $envAll "drydock" "api-test" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
{{ tuple $envAll "drydock" "api-test" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
||||||
spec:
|
spec:
|
||||||
|
@ -32,7 +33,7 @@ spec:
|
||||||
nodeSelector:
|
nodeSelector:
|
||||||
{{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }}
|
{{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }}
|
||||||
containers:
|
containers:
|
||||||
- name: "{{ .Release.Name }}-api-test"
|
- name: drydock-api-test
|
||||||
env:
|
env:
|
||||||
- name: 'DRYDOCK_URL'
|
- name: 'DRYDOCK_URL'
|
||||||
value: {{ tuple "physicalprovisioner" "internal" "api" . | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" | quote }}
|
value: {{ tuple "physicalprovisioner" "internal" "api" . | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" | quote }}
|
||||||
|
|
|
@ -22,10 +22,11 @@ requests */}}
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Pod
|
kind: Pod
|
||||||
metadata:
|
metadata:
|
||||||
name: "{{ .Release.Name }}-auth-test"
|
name: drydock-auth-test
|
||||||
annotations:
|
annotations:
|
||||||
helm.sh/hook: "test-success"
|
helm.sh/hook: "test-success"
|
||||||
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
|
||||||
|
{{ dict "envAll" $envAll "podName" "drydock-auth-test" "containerNames" (list "drydock-auth-test") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 4 }}
|
||||||
labels:
|
labels:
|
||||||
{{ tuple $envAll "drydock" "auth-test" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
{{ tuple $envAll "drydock" "auth-test" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
||||||
spec:
|
spec:
|
||||||
|
@ -33,7 +34,7 @@ spec:
|
||||||
nodeSelector:
|
nodeSelector:
|
||||||
{{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }}
|
{{ .Values.labels.test.node_selector_key }}: {{ .Values.labels.test.node_selector_value }}
|
||||||
containers:
|
containers:
|
||||||
- name: "{{ .Release.Name }}-auth-test"
|
- name: drydock-auth-test
|
||||||
env:
|
env:
|
||||||
- name: 'DRYDOCK_URL'
|
- name: 'DRYDOCK_URL'
|
||||||
value: {{ tuple "physicalprovisioner" "internal" "api" . | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" | quote }}
|
value: {{ tuple "physicalprovisioner" "internal" "api" . | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" | quote }}
|
||||||
|
|
|
@ -61,7 +61,18 @@ pod:
|
||||||
mandatory_access_control:
|
mandatory_access_control:
|
||||||
type: apparmor
|
type: apparmor
|
||||||
drydock-api:
|
drydock-api:
|
||||||
|
init: runtime/default
|
||||||
drydock-api: runtime/default
|
drydock-api: runtime/default
|
||||||
|
drydock-db-init:
|
||||||
|
init: runtime/default
|
||||||
|
drydock-db-init: runtime/default
|
||||||
|
drydock-db-sync:
|
||||||
|
init: runtime/default
|
||||||
|
drydock-db-sync: runtime/default
|
||||||
|
drydock-api-test:
|
||||||
|
drydock-api-test: runtime/default
|
||||||
|
drydock-auth-test:
|
||||||
|
drydock-auth-test: runtime/default
|
||||||
security_context:
|
security_context:
|
||||||
drydock:
|
drydock:
|
||||||
pod:
|
pod:
|
||||||
|
|
Loading…
Reference in New Issue