openstack
/
openstack-helm
Code Issues Proposed changes

Fix file permission and readOnly flag 

This patchset enforces stricter file permission on *-etc configmap and
sets readOnly flag to true in a number of charts.

Change-Id: I233689a5d56dd1352e0d81997a94b4cdd6bed5d2
Signed-off-by: Tin Lam <tin@irrational.io>
This commit is contained in:
Tin Lam 2017-06-29 14:36:44 -05:00
parent fecac47b5a
commit 670a78bcbe
72 changed files with 93 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
barbican/templates/deployment-api.yaml
View File

@ -91,6 +91,7 @@ spec:
- name: barbican-etc
configMap:
name: barbican-etc
defaultMode: 0444
- name: barbican-bin
configMap:
name: barbican-bin

5
barbican/templates/job-db-init.yaml
View File

@ -45,12 +45,12 @@ spec:
command:
- /tmp/db-init.py
volumeMounts:
- name: barbican-etc
mountPath: /etc/barbican
- name: barbican-bin
mountPath: /tmp/db-init.py
subPath: db-init.py
readOnly: true
- name: barbican-etc
mountPath: /etc/barbican
- name: barbican-conf
mountPath: /etc/barbican/barbican.conf
subPath: barbican.conf
@ -61,6 +61,7 @@ spec:
- name: barbican-conf
configMap:
name: barbican-etc
defaultMode: 0444
- name: barbican-bin
configMap:
name: barbican-bin

1
barbican/templates/job-db-sync.yaml
View File

@ -49,6 +49,7 @@ spec:
- name: barbican-etc
configMap:
name: barbican-etc
defaultMode: 0444
- name: barbican-bin
configMap:
name: barbican-bin

1
ceph/templates/daemonset-osd.yaml
View File

@ -114,6 +114,7 @@ spec:
- name: ceph-etc
configMap:
name: ceph-etc
defaultMode: 0444
- name: ceph-client-admin-keyring
secret:
secretName: {{ .Values.secrets.keyrings.admin }}

1
ceph/templates/deployment-mds.yaml
View File

@ -101,6 +101,7 @@ spec:
- name: ceph-etc
configMap:
name: ceph-etc
defaultMode: 0444
- name: ceph-client-admin-keyring
secret:
secretName: {{ .Values.secrets.keyrings.admin }}

1
ceph/templates/deployment-moncheck.yaml
View File

@ -92,6 +92,7 @@ spec:
- name: ceph-etc
configMap:
name: ceph-etc
defaultMode: 0444
- name: ceph-client-admin-keyring
secret:
secretName: {{ .Values.secrets.keyrings.admin }}

1
ceph/templates/deployment-rgw.yaml
View File

@ -104,6 +104,7 @@ spec:
- name: ceph-etc
configMap:
name: ceph-etc
defaultMode: 0444
- name: ceph-client-admin-keyring
secret:
secretName: {{ .Values.secrets.keyrings.admin }}

1
ceph/templates/job-keyring.yaml
View File

@ -81,5 +81,6 @@ spec:
- name: ceph-templates
configMap:
name: ceph-templates
defaultMode: 0444
{{ end }}
{{ end }}

1
ceph/templates/job-storage-admin-keys.yaml
View File

@ -74,4 +74,5 @@ spec:
- name: ceph-templates
configMap:
name: ceph-templates
defaultMode: 0444
{{- end }}

1
ceph/templates/statefulset-mon.yaml
View File

@ -133,6 +133,7 @@ spec:
- name: ceph-etc
configMap:
name: ceph-etc
defaultMode: 0444
- name: ceph-client-admin-keyring
secret:
secretName: {{ .Values.secrets.keyrings.admin }}

1
cinder/templates/deployment-api.yaml
View File

@ -85,4 +85,5 @@ spec:
- name: cinder-etc
configMap:
name: cinder-etc
defaultMode: 0444
{{- if $mounts_cinder_api.volumes }}{{ toYaml $mounts_cinder_api.volumes | indent 8 }}{{ end }}

2
cinder/templates/deployment-backup.yaml
View File

@ -88,6 +88,7 @@ spec:
- name: cinder-etc
configMap:
name: cinder-etc
defaultMode: 0444
- name: cinder-bin
configMap:
name: cinder-bin
@ -98,6 +99,7 @@ spec:
- name: ceph-etc
configMap:
name: ceph-etc
defaultMode: 0444
- name: ceph-keyring
secret:
secretName: pvc-ceph-client-key

1
cinder/templates/deployment-scheduler.yaml
View File

@ -71,4 +71,5 @@ spec:
- name: cinder-etc
configMap:
name: cinder-etc
defaultMode: 0444
{{- if $mounts_cinder_scheduler.volumes }}{{ toYaml $mounts_cinder_scheduler.volumes | indent 8 }}{{ end }}

1
cinder/templates/deployment-volume.yaml
View File

@ -102,6 +102,7 @@ spec:
- name: ceph-etc
configMap:
name: ceph-etc
defaultMode: 0444
- name: ceph-keyring
secret:
secretName: pvc-ceph-client-key

3
cinder/templates/job-bootstrap.yaml
View File

@ -43,13 +43,16 @@ spec:
- name: cinder-etc
mountPath: /etc/cinder/cinder.conf
subPath: cinder.conf
readOnly: true
- name: cinder-bin
mountPath: /tmp/bootstrap.sh
subPath: bootstrap.sh
readOnly: true
volumes:
- name: cinder-etc
configMap:
name: cinder-etc
defaultMode: 0444
- name: cinder-bin
configMap:
name: cinder-bin

1
cinder/templates/job-db-init.yaml
View File

@ -63,6 +63,7 @@ spec:
- name: cinder-etc
configMap:
name: cinder-etc
defaultMode: 0444
- name: cinder-bin
configMap:
name: cinder-bin

1
cinder/templates/pod-rally-test.yaml
View File

@ -56,6 +56,7 @@ spec:
- name: cinder-etc
configMap:
name: cinder-etc
defaultMode: 0444
- name: cinder-bin
configMap:
name: cinder-bin

3
glance/templates/deployment-api.yaml
View File

@ -67,6 +67,7 @@ spec:
- name: glance-bin
mountPath: /tmp/ceph-keyring.sh
subPath: ceph-keyring.sh
readOnly: true
- name: ceph-keyring
mountPath: /tmp/client-keyring
subPath: key
@ -136,6 +137,7 @@ spec:
- name: glance-etc
configMap:
name: glance-etc
defaultMode: 0444
{{- if eq .Values.storage "pvc" }}
- name: glance-images
persistentVolumeClaim:
@ -146,6 +148,7 @@ spec:
- name: ceph-etc
configMap:
name: ceph-etc
defaultMode: 0444
- name: ceph-keyring
secret:
secretName: pvc-ceph-client-key

1
glance/templates/deployment-registry.yaml
View File

@ -88,4 +88,5 @@ spec:
- name: glance-etc
configMap:
name: glance-etc
defaultMode: 0444
{{- if $mounts_glance_registry.volumes }}{{ toYaml $mounts_glance_registry.volumes | indent 8 }}{{ end }}

1
glance/templates/job-bootstrap.yaml
View File

@ -59,3 +59,4 @@ spec:
- name: glance-etc
configMap:
name: glance-etc
defaultMode: 0444

1
glance/templates/job-db-init.yaml
View File

@ -63,6 +63,7 @@ spec:
- name: glance-etc
configMap:
name: glance-etc
defaultMode: 0444
- name: glance-bin
configMap:
name: glance-bin

1
glance/templates/job-db-sync.yaml
View File

@ -51,6 +51,7 @@ spec:
- name: glance-etc
configMap:
name: glance-etc
defaultMode: 0444
- name: glance-bin
configMap:
name: glance-bin

1
glance/templates/pod-rally-test.yaml
View File

@ -56,6 +56,7 @@ spec:
- name: glance-etc
configMap:
name: glance-etc
defaultMode: 0444
- name: glance-bin
configMap:
name: glance-bin

1
heat/templates/deployment-api.yaml
View File

@ -92,4 +92,5 @@ spec:
- name: heat-etc
configMap:
name: heat-etc
defaultMode: 0444
{{- if $mounts_heat_api.volumes }}{{ toYaml $mounts_heat_api.volumes | indent 8 }}{{ end }}

1
heat/templates/deployment-cfn.yaml
View File

@ -92,4 +92,5 @@ spec:
- name: heat-etc
configMap:
name: heat-etc
defaultMode: 0444
{{- if $mounts_heat_cfn.volumes }}{{ toYaml $mounts_heat_cfn.volumes | indent 8 }}{{ end }}

1
heat/templates/deployment-cloudwatch.yaml
View File

@ -92,4 +92,5 @@ spec:
- name: heat-etc
configMap:
name: heat-etc
defaultMode: 0444
{{- if $mounts_heat_cloudwatch.volumes }}{{ toYaml $mounts_heat_cloudwatch.volumes | indent 8 }}{{ end }}

1
heat/templates/job-db-init.yaml
View File

@ -63,6 +63,7 @@ spec:
- name: heat-etc
configMap:
name: heat-etc
defaultMode: 0444
- name: heat-bin
configMap:
name: heat-bin

1
heat/templates/job-db-sync.yaml
View File

@ -51,6 +51,7 @@ spec:
- name: heat-etc
configMap:
name: heat-etc
defaultMode: 0444
- name: heat-bin
configMap:
name: heat-bin

1
heat/templates/statefulset-engine.yaml
View File

@ -72,4 +72,5 @@ spec:
- name: heat-etc
configMap:
name: heat-etc
defaultMode: 0444
{{- if $mounts_heat_engine.volumes }}{{ toYaml $mounts_heat_engine.volumes | indent 8 }}{{ end }}

1
horizon/templates/deployment.yaml
View File

@ -82,4 +82,5 @@ spec:
- name: horizon-etc
configMap:
name: horizon-etc
defaultMode: 0444
{{- if $mounts_horizon.volumes }}{{ toYaml $mounts_horizon.volumes | indent 8 }}{{ end }}

2
ingress/templates/deployment-ingress.yaml
View File

@ -74,8 +74,10 @@ spec:
- name: ingress-etc
mountPath: /etc/resolv.conf
subPath: resolv.conf
readOnly: true
volumes:
- name: ingress-etc
configMap:
name: ingress-etc
defaultMode: 0444
{{- end }}

1
keystone/templates/deployment.yaml
View File

@ -103,6 +103,7 @@ spec:
- name: keystone-etc
configMap:
name: keystone-etc
defaultMode: 0444
- name: keystone-bin
configMap:
name: keystone-bin

1
keystone/templates/job-bootstrap.yaml
View File

@ -45,6 +45,7 @@ spec:
- name: keystone-bin
mountPath: /tmp/bootstrap.sh
subPath: bootstrap.sh
readOnly: true
{{- if $mounts_keystone_bootstrap.volumeMounts }}{{ toYaml $mounts_keystone_bootstrap.volumeMounts | indent 10 }}{{ end }}
volumes:
- name: keystone-bin

1
keystone/templates/job-db-init.yaml
View File

@ -67,6 +67,7 @@ spec:
- name: keystone-etc
configMap:
name: keystone-etc
defaultMode: 0444
- name: keystone-bin
configMap:
name: keystone-bin

1
keystone/templates/job-db-sync.yaml
View File

@ -66,6 +66,7 @@ spec:
- name: keystone-etc
configMap:
name: keystone-etc
defaultMode: 0444
- name: keystone-bin
configMap:
name: keystone-bin

1
keystone/templates/pod-rally-test.yaml
View File

@ -56,6 +56,7 @@ spec:
- name: keystone-etc
configMap:
name: keystone-etc
defaultMode: 0444
- name: keystone-bin
configMap:
name: keystone-bin

1
magnum/templates/deployment-api.yaml
View File

@ -92,4 +92,5 @@ spec:
- name: magnum-etc
configMap:
name: magnum-etc
defaultMode: 0444
{{- if $mounts_magnum_api.volumes }}{{ toYaml $mounts_magnum_api.volumes | indent 8 }}{{ end }}

1
magnum/templates/job-db-init.yaml
View File

@ -63,6 +63,7 @@ spec:
- name: magnum-etc
configMap:
name: magnum-etc
defaultMode: 0444
- name: magnum-bin
configMap:
name: magnum-bin

1
magnum/templates/job-db-sync.yaml
View File

@ -51,6 +51,7 @@ spec:
- name: magnum-etc
configMap:
name: magnum-etc
defaultMode: 0444
- name: magnum-bin
configMap:
name: magnum-bin

1
magnum/templates/statefulset-conductor.yaml
View File

@ -72,4 +72,5 @@ spec:
- name: magnum-etc
configMap:
name: magnum-etc
defaultMode: 0444
{{- if $mounts_magnum_conductor.volumes }}{{ toYaml $mounts_magnum_conductor.volumes | indent 8 }}{{ end }}

1
mariadb/templates/statefulset.yaml
View File

@ -100,6 +100,7 @@ spec:
- name: mariadb-etc
configMap:
name: mariadb-etc
defaultMode: 0444
{{- if not .Values.volume.enabled }}
- name: mysql-data
emptyDir: {}

1
mistral/templates/deployment-api.yaml
View File

@ -85,4 +85,5 @@ spec:
- name: mistral-etc
configMap:
name: mistral-etc
defaultMode: 0444
{{- if $mounts_mistral_api.volumes }}{{ toYaml $mounts_mistral_api.volumes | indent 8 }}{{ end }}

1
mistral/templates/deployment-executor.yaml
View File

@ -67,4 +67,5 @@ spec:
- name: mistral-etc
configMap:
name: mistral-etc
defaultMode: 0444
{{- if $mounts_mistral_executor.volumes }}{{ toYaml $mounts_mistral_executor.volumes | indent 8 }}{{ end }}

1
mistral/templates/job-db-init.yaml
View File

@ -67,3 +67,4 @@ spec:
- name: mistral-etc
configMap:
name: mistral-etc
defaultMode: 0444

1
mistral/templates/job-db-sync.yaml
View File

@ -51,6 +51,7 @@ spec:
- name: mistral-etc
configMap:
name: mistral-etc
defaultMode: 0444
- name: mistral-bin
configMap:
name: mistral-bin

1
mistral/templates/statefulset-engine.yaml
View File

@ -62,4 +62,5 @@ spec:
- name: mistral-etc
configMap:
name: mistral-etc
defaultMode: 0444
{{- if $mounts_mistral_engine.volumes }}{{ toYaml $mounts_mistral_engine.volumes | indent 8 }}{{ end }}

1
mistral/templates/statefulset-event-engine.yaml
View File

@ -64,4 +64,5 @@ spec:
- name: mistral-etc
configMap:
name: mistral-etc
defaultMode: 0444
{{- if $mounts_mistral_event_engine.volumes }}{{ toYaml $mounts_mistral_event_engine.volumes | indent 8 }}{{ end }}

1
neutron/templates/daemonset-dhcp-agent.yaml
View File

@ -90,6 +90,7 @@ spec:
- name: neutron-etc
configMap:
name: neutron-etc
defaultMode: 0444
- name: runopenvswitch
hostPath:
path: /run/openvswitch

1
neutron/templates/daemonset-l3-agent.yaml
View File

@ -89,6 +89,7 @@ spec:
- name: neutron-etc
configMap:
name: neutron-etc
defaultMode: 0444
- name: runopenvswitch
hostPath:
path: /run/openvswitch

1
neutron/templates/daemonset-metadata-agent.yaml
View File

@ -88,6 +88,7 @@ spec:
- name: neutron-etc
configMap:
name: neutron-etc
defaultMode: 0444
- name: runopenvswitch
hostPath:
path: /run/openvswitch

1
neutron/templates/daemonset-ovs-agent.yaml
View File

@ -131,6 +131,7 @@ spec:
- name: neutron-etc
configMap:
name: neutron-etc
defaultMode: 0444
- name: libmodules
hostPath:
path: /lib/modules

1
neutron/templates/daemonset-ovs-db.yaml
View File

@ -66,6 +66,7 @@ spec:
- name: neutron-etc
configMap:
name: neutron-etc
defaultMode: 0444
- name: libmodules
hostPath:
path: /lib/modules

1
neutron/templates/deployment-server.yaml
View File

@ -88,4 +88,5 @@ spec:
- name: neutron-etc
configMap:
name: neutron-etc
defaultMode: 0444
{{- if $mounts_neutron_server.volumes }}{{ toYaml $mounts_neutron_server.volumes | indent 8 }}{{ end }}

1
neutron/templates/job-db-init.yaml
View File

@ -63,6 +63,7 @@ spec:
- name: neutron-etc
configMap:
name: neutron-etc
defaultMode: 0444
- name: neutron-bin
configMap:
name: neutron-bin

1
neutron/templates/job-db-sync.yaml
View File

@ -64,6 +64,7 @@ spec:
- name: neutron-etc
configMap:
name: neutron-etc
defaultMode: 0444
- name: neutron-bin
configMap:
name: neutron-bin

1
neutron/templates/pod-rally-test.yaml
View File

@ -56,6 +56,7 @@ spec:
- name: neutron-etc
configMap:
name: neutron-etc
defaultMode: 0444
- name: neutron-bin
configMap:
name: neutron-bin

2
nova/templates/daemonset-compute.yaml
View File

@ -167,12 +167,14 @@ spec:
- name: nova-etc
configMap:
name: nova-etc
defaultMode: 0444
{{- if .Values.ceph.enabled }}
- name: etcceph
emptyDir: {}
- name: ceph-etc
configMap:
name: ceph-etc
defaultMode: 0444
- name: ceph-keyring
secret:
secretName: pvc-ceph-client-key

3
nova/templates/daemonset-libvirt.yaml
View File

@ -52,6 +52,7 @@ spec:
- name: nova-bin
mountPath: /tmp/ceph-keyring.sh
subPath: ceph-keyring.sh
readOnly: true
- name: ceph-keyring
mountPath: /tmp/client-keyring
subPath: key
@ -136,12 +137,14 @@ spec:
- name: nova-etc
configMap:
name: nova-etc
defaultMode: 0444
{{- if .Values.ceph.enabled }}
- name: etcceph
emptyDir: {}
- name: ceph-etc
configMap:
name: ceph-etc
defaultMode: 0444
- name: ceph-keyring
secret:
secretName: pvc-ceph-client-key

1
nova/templates/deployment-api-metadata.yaml
View File

@ -96,4 +96,5 @@ spec:
- name: nova-etc
configMap:
name: nova-etc
defaultMode: 0444
{{- if $mounts_nova_api_metadata.volumes }}{{ toYaml $mounts_nova_api_metadata.volumes | indent 8 }}{{ end }}

1
nova/templates/deployment-api-osapi.yaml
View File

@ -84,4 +84,5 @@ spec:
- name: nova-etc
configMap:
name: nova-etc
defaultMode: 0444
{{- if $mounts_nova_api_osapi.volumes}}{{ toYaml $mounts_nova_api_osapi.volumes | indent 8 }}{{ end }}

1
nova/templates/deployment-conductor.yaml
View File

@ -67,4 +67,5 @@ spec:
- name: nova-etc
configMap:
name: nova-etc
defaultMode: 0444
{{- if $mounts_nova_conductor.volumes }}{{ toYaml $mounts_nova_conductor.volumes | indent 8 }}{{ end }}

1
nova/templates/deployment-consoleauth.yaml
View File

@ -67,4 +67,5 @@ spec:
- name: nova-etc
configMap:
name: nova-etc
defaultMode: 0444
{{- if $mounts_nova_consoleauth.volumes }}{{ toYaml $mounts_nova_consoleauth.volumes | indent 8 }}{{ end }}

1
nova/templates/deployment-scheduler.yaml
View File

@ -67,4 +67,5 @@ spec:
- name: nova-etc
configMap:
name: nova-etc
defaultMode: 0444
{{- if $mounts_nova_scheduler.volumes }}{{ toYaml $mounts_nova_scheduler.volumes | indent 8 }}{{ end }}

1
nova/templates/job-bootstrap.yaml
View File

@ -54,6 +54,7 @@ spec:
- name: nova-etc
configMap:
name: nova-etc
defaultMode: 0444
- name: nova-bin
configMap:
name: nova-bin

1
nova/templates/job-db-init.yaml
View File

@ -92,6 +92,7 @@ spec:
- name: nova-etc
configMap:
name: nova-etc
defaultMode: 0444
- name: nova-bin
configMap:
name: nova-bin

1
nova/templates/job-db-sync.yaml
View File

@ -51,6 +51,7 @@ spec:
- name: nova-etc
configMap:
name: nova-etc
defaultMode: 0444
- name: nova-bin
configMap:
name: nova-bin

1
nova/templates/pod-rally-test.yaml
View File

@ -54,6 +54,7 @@ spec:
- name: nova-etc
configMap:
name: nova-etc
defaultMode: 0444
- name: nova-bin
configMap:
name: nova-bin

20
rabbitmq/templates/deployment.yaml
View File

@ -40,15 +40,6 @@ spec:
{{ tuple $envAll "rabbitmq" "server" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
nodeSelector:
{{ .Values.labels.node_selector_key }}: {{ .Values.labels.node_selector_value }}
volumes:
- name: rabbitmq-emptydir
emptyDir: {}
- name: rabbitmq-bin
configMap:
name: rabbitmq-bin
- name: rabbitmq-etc
configMap:
name: rabbitmq-etc
initContainers:
{{ tuple $envAll $dependencies "[]" | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 9 }}
containers:
@ -105,3 +96,14 @@ spec:
mountPath: /etc/rabbitmq/rabbitmq.config
subPath: rabbitmq.config
readOnly: true
volumes:
- name: rabbitmq-emptydir
emptyDir: {}
- name: rabbitmq-bin
configMap:
name: rabbitmq-bin
defaultMode: 0555
- name: rabbitmq-etc
configMap:
name: rabbitmq-etc
defaultMode: 0444

1
senlin/templates/deployment-api.yaml
View File

@ -92,4 +92,5 @@ spec:
- name: senlin-etc
configMap:
name: senlin-etc
defaultMode: 0444
{{- if $mounts_senlin_api.volumes }}{{ toYaml $mounts_senlin_api.volumes | indent 8 }}{{ end }}

1
senlin/templates/job-db-init.yaml
View File

@ -63,6 +63,7 @@ spec:
- name: senlin-etc
configMap:
name: senlin-etc
defaultMode: 0444
- name: senlin-bin
configMap:
name: senlin-bin

1
senlin/templates/job-db-sync.yaml
View File

@ -51,6 +51,7 @@ spec:
- name: senlin-etc
configMap:
name: senlin-etc
defaultMode: 0444
- name: senlin-bin
configMap:
name: senlin-bin

1
senlin/templates/statefulset-engine.yaml
View File

@ -72,4 +72,5 @@ spec:
- name: senlin-etc
configMap:
name: senlin-etc
defaultMode: 0444
{{- if $mounts_senlin_engine.volumes }}{{ toYaml $mounts_senlin_engine.volumes | indent 8 }}{{ end }}