From bcb6f71894a2faebe77037ac5619d2c2b0db25f0 Mon Sep 17 00:00:00 2001 From: "dt241s@att.com" Date: Wed, 26 Feb 2020 17:35:13 +0000 Subject: [PATCH] Enable Apparmor to Heat Components Change-Id: I706b7503520b80bf5a4f0f34cb1be3298e2ad4ca --- heat/templates/deployment-api.yaml | 1 + heat/templates/deployment-cfn.yaml | 1 + heat/templates/deployment-engine.yaml | 1 + heat/templates/job-ks-user-domain.yaml | 5 +++++ heat/templates/job-trusts.yaml | 5 +++++ heat/values_overrides/apparmor.yaml | 18 ++++++++++++++++++ 6 files changed, 31 insertions(+) create mode 100644 heat/values_overrides/apparmor.yaml diff --git a/heat/templates/deployment-api.yaml b/heat/templates/deployment-api.yaml index 36834ee6d0..239b2e8745 100644 --- a/heat/templates/deployment-api.yaml +++ b/heat/templates/deployment-api.yaml @@ -45,6 +45,7 @@ spec: {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} +{{ dict "envAll" $envAll "podName" "heat-api" "containerNames" (list "heat-api" "init" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: serviceAccountName: {{ $serviceAccountName }} {{ dict "envAll" $envAll "application" "heat" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} diff --git a/heat/templates/deployment-cfn.yaml b/heat/templates/deployment-cfn.yaml index e21a48040b..94702ecdb9 100644 --- a/heat/templates/deployment-cfn.yaml +++ b/heat/templates/deployment-cfn.yaml @@ -45,6 +45,7 @@ spec: {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} +{{ dict "envAll" $envAll "podName" "heat-cfn" "containerNames" (list "heat-cfn" "init" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: serviceAccountName: {{ $serviceAccountName }} {{ dict "envAll" $envAll "application" "heat" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} diff --git a/heat/templates/deployment-engine.yaml b/heat/templates/deployment-engine.yaml index 43b4f30cdb..0b24cc62c3 100644 --- a/heat/templates/deployment-engine.yaml +++ b/heat/templates/deployment-engine.yaml @@ -52,6 +52,7 @@ spec: {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} +{{ dict "envAll" $envAll "podName" "heat-engine" "containerNames" (list "heat-engine" "init" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} {{- end }} spec: serviceAccountName: {{ $serviceAccountName }} diff --git a/heat/templates/job-ks-user-domain.yaml b/heat/templates/job-ks-user-domain.yaml index f8b685b86c..c8007aaac9 100644 --- a/heat/templates/job-ks-user-domain.yaml +++ b/heat/templates/job-ks-user-domain.yaml @@ -31,6 +31,11 @@ spec: metadata: labels: {{ tuple $envAll "heat" "ks-user" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }} + annotations: +{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} + configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} + configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} +{{ dict "envAll" $envAll "podName" "heat-domain-ks-user" "containerNames" (list "heat-ks-domain-user" "init" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: serviceAccountName: {{ $serviceAccountName }} restartPolicy: OnFailure diff --git a/heat/templates/job-trusts.yaml b/heat/templates/job-trusts.yaml index cff432ca22..ecba8e0ae4 100644 --- a/heat/templates/job-trusts.yaml +++ b/heat/templates/job-trusts.yaml @@ -33,6 +33,11 @@ spec: metadata: labels: {{ tuple $envAll "heat" "trusts" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }} + annotations: +{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} + configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} + configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} +{{ dict "envAll" $envAll "podName" "heat-trusts" "containerNames" (list "heat-trusts" "init" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: serviceAccountName: {{ $serviceAccountName }} restartPolicy: OnFailure diff --git a/heat/values_overrides/apparmor.yaml b/heat/values_overrides/apparmor.yaml new file mode 100644 index 0000000000..079abfb04c --- /dev/null +++ b/heat/values_overrides/apparmor.yaml @@ -0,0 +1,18 @@ +pod: + mandatory_access_control: + type: apparmor + heat-api: + heat-api: runtime/default + init: runtime/default + heat-cfn: + heat-cfn: runtime/default + init: runtime/default + heat-engine: + heat-engine: runtime/default + init: runtime/default + heat-domain-ks-user: + heat-ks-domain-user: runtime/default + init: runtime/default + heat-trusts: + heat-trusts: runtime/default + init: runtime/default \ No newline at end of file