From 294866a81c9a636dea372960ef26c4b1170813a3 Mon Sep 17 00:00:00 2001 From: pd2839 Date: Tue, 26 Feb 2019 15:35:50 -0600 Subject: [PATCH] readOnlyFilesystem: true for heat chart fix for adding readOnlyFilesystem flag at pod level Change-Id: I014cf0f9c6c19e900d3c210a7f52b4e941bc46e7 --- heat/templates/deployment-api.yaml | 2 ++ heat/templates/deployment-cfn.yaml | 2 ++ heat/templates/deployment-cloudwatch.yaml | 2 ++ heat/templates/deployment-engine.yaml | 2 ++ 4 files changed, 8 insertions(+) diff --git a/heat/templates/deployment-api.yaml b/heat/templates/deployment-api.yaml index 50dd48c86a..ac615355ad 100644 --- a/heat/templates/deployment-api.yaml +++ b/heat/templates/deployment-api.yaml @@ -46,6 +46,8 @@ spec: configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} spec: + securityContext: + readOnlyRootFilesystem: true serviceAccountName: {{ $serviceAccountName }} {{ dict "envAll" $envAll "application" "heat" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} affinity: diff --git a/heat/templates/deployment-cfn.yaml b/heat/templates/deployment-cfn.yaml index ad91bb657c..f1d58b081d 100644 --- a/heat/templates/deployment-cfn.yaml +++ b/heat/templates/deployment-cfn.yaml @@ -46,6 +46,8 @@ spec: configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} spec: + securityContext: + readOnlyRootFilesystem: true serviceAccountName: {{ $serviceAccountName }} {{ dict "envAll" $envAll "application" "heat" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} affinity: diff --git a/heat/templates/deployment-cloudwatch.yaml b/heat/templates/deployment-cloudwatch.yaml index a89ad13539..fc0173f206 100644 --- a/heat/templates/deployment-cloudwatch.yaml +++ b/heat/templates/deployment-cloudwatch.yaml @@ -46,6 +46,8 @@ spec: configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} spec: + securityContext: + readOnlyRootFilesystem: true serviceAccountName: {{ $serviceAccountName }} {{ dict "envAll" $envAll "application" "heat" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} affinity: diff --git a/heat/templates/deployment-engine.yaml b/heat/templates/deployment-engine.yaml index 5c091a036c..b3d0a02a71 100644 --- a/heat/templates/deployment-engine.yaml +++ b/heat/templates/deployment-engine.yaml @@ -54,6 +54,8 @@ spec: configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} {{- end }} spec: + securityContext: + readOnlyRootFilesystem: true serviceAccountName: {{ $serviceAccountName }} {{ dict "envAll" $envAll "application" "heat" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} affinity: