From 1d0e21e3701cb80d71eae1f1e28b070daf955c56 Mon Sep 17 00:00:00 2001
From: pd2839 <pd2839@att.com>
Date: Mon, 18 Mar 2019 14:19:21 -0500
Subject: [PATCH] Implement Security Context for Glance

Implement container security context for the following Glance resources:
 - Glance server deployment

Change-Id: I32b63226f5f2bcfff09f0b6760f5475ef7d1b5b5
---
 glance/templates/deployment-api.yaml      |  3 +--
 glance/templates/deployment-registry.yaml |  3 +--
 glance/values.yaml                        | 12 ++++++++++--
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/glance/templates/deployment-api.yaml b/glance/templates/deployment-api.yaml
index e7c4ec62a9..17b6487e75 100644
--- a/glance/templates/deployment-api.yaml
+++ b/glance/templates/deployment-api.yaml
@@ -92,8 +92,7 @@ spec:
         - name: glance-api
 {{ tuple $envAll "glance_api" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
-          securityContext:
-            allowPrivilegeEscalation: false
+{{ dict "envAll" $envAll "application" "glance" "container" "glance_api" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           command:
             - /tmp/glance-api.sh
             - start
diff --git a/glance/templates/deployment-registry.yaml b/glance/templates/deployment-registry.yaml
index bb82d024a9..25f90d78d6 100644
--- a/glance/templates/deployment-registry.yaml
+++ b/glance/templates/deployment-registry.yaml
@@ -59,8 +59,7 @@ spec:
         - name: glance-registry
 {{ tuple $envAll "glance_registry" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.registry | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
-          securityContext:
-            allowPrivilegeEscalation: false
+{{ dict "envAll" $envAll "application" "glance" "container" "glance_registry" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           command:
             - /tmp/glance-registry.sh
             - start
diff --git a/glance/values.yaml b/glance/values.yaml
index 0b84216631..3901d64304 100644
--- a/glance/values.yaml
+++ b/glance/values.yaml
@@ -786,9 +786,17 @@ endpoints:
     namespace: kube-public
 
 pod:
-  user:
+  security_context:
     glance:
-      uid: 42424
+      pod:
+        runAsUser: 42424
+      container:
+        glance_api:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+        glance_registry:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
   affinity:
     anti:
       type: