Skip to content

Commit 132583c

Browse files
cognifloydcognifloyd
authored
Merge pull request #410 from StackStorm/securityContextDefaults
add securityContext for more containers with better fallbacks
2 parents 14d4559 + 6ab5d02 commit 132583c

File tree

6 files changed

+239
-23
lines changed

6 files changed

+239
-23
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
## Development
44
* Fix syntax with ensure-packs-volumes-are-writable job (#403) (by @skiedude)
5+
* Add securityContext support to custom st2packs images, extra_hooks jobs; Also fallback to st2actionrunner securityContext for misc init container jobs and pods. (#410) (by @cognifloyd)
56

67
## v1.0.0
78
* Bump to latest CircleCI orb versions ([email protected] and [email protected] by @ZoeLeah)

‎templates/_helpers.tpl

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -344,7 +344,8 @@ Merge packs and virtualenvs from st2 with those from st2packs images
344344
- |
345345
/bin/cp -aR /opt/stackstorm/packs/. /opt/stackstorm/packs-shared &&
346346
/bin/cp -aR /opt/stackstorm/virtualenvs/. /opt/stackstorm/virtualenvs-shared
347-
{{- with $.Values.securityContext }}
347+
{{- with .securityContext | default $.Values.st2actionrunner.securityContext | default $.Values.securityContext }}
348+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
348349
securityContext: {{- toYaml . | nindent 8 }}
349350
{{- end }}
350351
{{- end }}
@@ -365,7 +366,8 @@ Merge packs and virtualenvs from st2 with those from st2packs images
365366
- |
366367
/bin/cp -aR /opt/stackstorm/packs/. /opt/stackstorm/packs-shared &&
367368
/bin/cp -aR /opt/stackstorm/virtualenvs/. /opt/stackstorm/virtualenvs-shared
368-
{{- with .Values.securityContext }}
369+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
370+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
369371
securityContext: {{- toYaml . | nindent 8 }}
370372
{{- end }}
371373
{{- end }}
@@ -384,7 +386,8 @@ Merge packs and virtualenvs from st2 with those from st2packs images
384386
- '-ec'
385387
- |
386388
/bin/cp -aR /opt/stackstorm/configs/. /opt/stackstorm/configs-shared
387-
{{- with .Values.securityContext }}
389+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
390+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
388391
securityContext: {{- toYaml . | nindent 8 }}
389392
{{- end }}
390393
{{- end }}

‎templates/deployments.yaml

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -428,7 +428,7 @@ spec:
428428
- name: st2web
429429
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2web:{{ tpl (.Values.st2web.image.tag | default .Values.image.tag) . }}'
430430
imagePullPolicy: {{ .Values.image.pullPolicy }}
431-
{{- with default .Values.securityContext .Values.st2web.securityContext }}
431+
{{- with .Values.st2web.securityContext | default .Values.securityContext }}
432432
securityContext: {{- toYaml . | nindent 10 }}
433433
{{- end }}
434434
ports:
@@ -515,7 +515,7 @@ spec:
515515
{{- with .Values.dnsConfig }}
516516
dnsConfig: {{- toYaml . | nindent 8 }}
517517
{{- end }}
518-
{{- with default .Values.podSecurityContext .Values.st2client.podSecurityContext }}
518+
{{- with .Values.st2web.podSecurityContext | default .Values.podSecurityContext }}
519519
securityContext: {{- toYaml . | nindent 8 }}
520520
{{- end }}
521521
{{- with .Values.st2web.nodeSelector }}
@@ -1187,7 +1187,7 @@ spec:
11871187
- name: {{ $name }}
11881188
image: '{{ template "stackstorm-ha.imageRepository" $ }}/st2sensorcontainer:{{ tpl ($sensor.image.tag | default $.Values.image.tag) $ }}'
11891189
imagePullPolicy: {{ $.Values.image.pullPolicy }}
1190-
{{- with default $.Values.securityContext $sensor.securityContext }}
1190+
{{- with $sensor.securityContext | default $.Values.securityContext }}
11911191
securityContext: {{- toYaml . | nindent 10 }}
11921192
{{- end }}
11931193
{{- with $sensor.readinessProbe }}
@@ -1282,7 +1282,7 @@ spec:
12821282
{{- with $.Values.dnsConfig }}
12831283
dnsConfig: {{- toYaml . | nindent 8 }}
12841284
{{- end }}
1285-
{{- with default $.Values.podSecurityContext $sensor.podSecurityContext }}
1285+
{{- with $sensor.podSecurityContext | default $.Values.podSecurityContext }}
12861286
securityContext: {{- toYaml . | nindent 8 }}
12871287
{{- end }}
12881288
{{- with $sensor.nodeSelector }}
@@ -1353,7 +1353,7 @@ spec:
13531353
image: '{{ .image.repository | default (include "stackstorm-ha.imageRepository" $) }}/{{ .image.name | default "st2actionrunner" }}:{{ tpl (.image.tag | default $.Values.image.tag) $ }}'
13541354
{{- end }}
13551355
imagePullPolicy: {{ .Values.st2actionrunner.image.pullPolicy | default .Values.image.pullPolicy }}
1356-
{{- with default .Values.securityContext .Values.st2actionrunner.securityContext }}
1356+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
13571357
securityContext: {{- toYaml . | nindent 10 }}
13581358
{{- end }}
13591359
# TODO: Add liveness/readiness probes (#3)
@@ -1436,7 +1436,7 @@ spec:
14361436
{{- with .Values.dnsConfig }}
14371437
dnsConfig: {{- toYaml . | nindent 8 }}
14381438
{{- end }}
1439-
{{- with default .Values.podSecurityContext .Values.st2actionrunner.podSecurityContext }}
1439+
{{- with .Values.st2actionrunner.podSecurityContext | default .Values.podSecurityContext }}
14401440
securityContext: {{- toYaml . | nindent 8 }}
14411441
{{- end }}
14421442
{{- with .Values.st2actionrunner.nodeSelector }}
@@ -1600,7 +1600,7 @@ spec:
16001600
- name: generate-st2client-config
16011601
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2actionrunner:{{ tpl (.Values.st2client.image.tag | default (.Values.st2actionrunner.image.tag | default .Values.image.tag)) . }}'
16021602
imagePullPolicy: {{ .Values.image.pullPolicy }}
1603-
{{- with .Values.securityContext }}
1603+
{{- with .Values.st2client.securityContext | default .Values.st2actionrunner.securityContext | default .Values.securityContext }}
16041604
securityContext: {{- toYaml . | nindent 10 }}
16051605
{{- end }}
16061606
envFrom:
@@ -1627,7 +1627,7 @@ spec:
16271627
- name: st2client
16281628
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2actionrunner:{{ tpl (.Values.st2client.image.tag | default .Values.image.tag) . }}'
16291629
imagePullPolicy: {{ .Values.image.pullPolicy }}
1630-
{{- with default .Values.securityContext .Values.st2actionrunner.securityContext }}
1630+
{{- with .Values.st2client.securityContext | default .Values.st2actionrunner.securityContext | default .Values.securityContext }}
16311631
securityContext: {{- toYaml . | nindent 10 }}
16321632
{{- end }}
16331633
env:
@@ -1728,7 +1728,7 @@ spec:
17281728
{{- with .Values.dnsConfig }}
17291729
dnsConfig: {{- toYaml . | nindent 8 }}
17301730
{{- end }}
1731-
{{- with default .Values.podSecurityContext .Values.st2client.podSecurityContext }}
1731+
{{- with .Values.st2client.podSecurityContext | default .Values.st2actionrunner.podSecurityContext | default .Values.podSecurityContext }}
17321732
securityContext: {{- toYaml . | nindent 8 }}
17331733
{{- end }}
17341734
{{- with .Values.st2client.nodeSelector }}

‎templates/jobs.yaml

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -411,7 +411,8 @@ spec:
411411
- name: st2-register-content-custom-init
412412
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2actionrunner:{{ tpl (.Values.jobs.image.tag | default (.Values.st2actionrunner.image.tag | default .Values.image.tag)) . }}'
413413
imagePullPolicy: {{ .Values.image.pullPolicy }}
414-
{{- with .Values.securityContext }}
414+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
415+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
415416
securityContext: {{- toYaml . | nindent 10 }}
416417
{{- end }}
417418
command: {{- toYaml $.Values.jobs.preRegisterContentCommand | nindent 8 }}
@@ -425,7 +426,8 @@ spec:
425426
- name: st2-register-content
426427
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2actionrunner:{{ tpl (.Values.jobs.image.tag | default (.Values.st2actionrunner.image.tag | default .Values.image.tag)) . }}'
427428
imagePullPolicy: {{ .Values.image.pullPolicy }}
428-
{{- with .Values.securityContext }}
429+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
430+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
429431
securityContext: {{- toYaml . | nindent 10 }}
430432
{{- end }}
431433
command:
@@ -470,7 +472,8 @@ spec:
470472
{{- with .Values.dnsConfig }}
471473
dnsConfig: {{- toYaml . | nindent 8 }}
472474
{{- end }}
473-
{{- with .Values.podSecurityContext }}
475+
{{- with .Values.st2actionrunner.podSecurityContext | default .Values.podSecurityContext }}
476+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
474477
securityContext: {{- toYaml . | nindent 8 }}
475478
{{- end }}
476479
{{- with .Values.jobs.nodeSelector }}
@@ -641,7 +644,7 @@ spec:
641644
- name: generate-st2client-config
642645
image: '{{ template "stackstorm-ha.imageRepository" $ }}/st2actionrunner:{{ tpl ($.Values.jobs.image.tag | default ($.Values.st2actionrunner.image.tag | default $.Values.image.tag)) $ }}'
643646
imagePullPolicy: {{ $.Values.image.pullPolicy }}
644-
{{- with $.Values.securityContext }}
647+
{{- with $.Values.st2actionrunner.securityContext | default $.Values.securityContext }}
645648
securityContext: {{- toYaml . | nindent 10 }}
646649
{{- end }}
647650
envFrom:
@@ -668,7 +671,7 @@ spec:
668671
- name: {{ $name }}
669672
image: '{{ template "stackstorm-ha.imageRepository" $ }}/st2actionrunner:{{ tpl ($.Values.jobs.image.tag | default ($.Values.st2actionrunner.image.tag | default $.Values.image.tag)) $ }}'
670673
imagePullPolicy: {{ $.Values.image.pullPolicy }}
671-
{{- with $.Values.securityContext }}
674+
{{- with .securityContext | default $.Values.st2actionrunner.securityContext | default $.Values.securityContext }}
672675
securityContext: {{- toYaml . | nindent 10 }}
673676
{{- end }}
674677
{{- if $.Values.jobs.env }}
@@ -718,7 +721,7 @@ spec:
718721
{{- with $.Values.dnsConfig }}
719722
dnsConfig: {{- toYaml . | nindent 8 }}
720723
{{- end }}
721-
{{- with $.Values.podSecurityContext }}
724+
{{- with .podSecurityContext | default $.Values.st2actionrunner.podSecurityContext | default $.Values.podSecurityContext }}
722725
securityContext: {{- toYaml . | nindent 8 }}
723726
{{- end }}
724727
{{- with $.Values.jobs.nodeSelector }}

0 commit comments

Comments
 (0)