diff --git a/memcached/templates/deployment.yaml b/memcached/templates/deployment.yaml index 931da801f..6962cf731 100644 --- a/memcached/templates/deployment.yaml +++ b/memcached/templates/deployment.yaml @@ -59,6 +59,7 @@ spec: - name: memcached {{ tuple $envAll "memcached" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.server | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} +{{ dict "envAll" $envAll "application" "server" "container" "memcached" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: - name: MEMCACHED_PORT value: {{ tuple "oslo_cache" "internal" "memcache" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }} diff --git a/memcached/templates/monitoring/prometheus/exporter-deployment.yaml b/memcached/templates/monitoring/prometheus/exporter-deployment.yaml index 33fda3965..fb12cc1e6 100644 --- a/memcached/templates/monitoring/prometheus/exporter-deployment.yaml +++ b/memcached/templates/monitoring/prometheus/exporter-deployment.yaml @@ -53,8 +53,7 @@ spec: image: {{ .Values.images.tags.prometheus_memcached_exporter }} imagePullPolicy: {{ .Values.images.pull_policy }} {{ tuple $envAll $envAll.Values.pod.resources.prometheus_memcached_exporter | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} - securityContext: - allowPrivilegeEscalation: false +{{ dict "envAll" $envAll "application" "memcached_exporter" "container" "memcached_exporter" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} command: - /tmp/memcached-exporter.sh - start diff --git a/memcached/values.yaml b/memcached/values.yaml index 8dfcf5464..c601c95fc 100644 --- a/memcached/values.yaml +++ b/memcached/values.yaml @@ -144,14 +144,20 @@ manifests: service_exporter: true pod: - user: + security_context: memcached_exporter: - uid: 65534 + pod: + runAsUser: 65534 + container: + memcached_exporter: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false server: - uid: 65534 - securityContext: - server: - readOnlyRootFilesystem: true + pod: + runAsUser: 65534 + container: + memcached: + readOnlyRootFilesystem: true affinity: anti: topologyKey: