Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

TT-9741 Add containerSecurityContext #95

Merged
merged 5 commits into from
Sep 13, 2023
Merged

TT-9741 Add containerSecurityContext #95

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7b89c1e
Add containerSecurityContext
zalbiraw Aug 10, 2023
a0225b9
Merge branch 'main' into TT-9741-add-containerSecurityContext
andrei-tyk Aug 30, 2023
9446f9c
Fix containerSecurityContext value for dashboard
komalsukhani Sep 4, 2023
9476a41
Merge branch 'main' into TT-9741-add-containerSecurityContext
singhpr Sep 5, 2023
229958f
Merge branch 'main' into TT-9741-add-containerSecurityContext
singhpr Sep 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions components/tyk-dashboard/templates/deployment-dashboard.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,9 +59,10 @@ spec:
- image: "{{ .Values.dashboard.image.repository }}:{{ .Values.dashboard.image.tag }}"
imagePullPolicy: {{ .Values.dashboard.image.pullPolicy }}
name: dashboard-{{ .Chart.Name }}
{{- if .Values.dashboard.containerSecurityContext }}
securityContext:
runAsUser: 999
runAsGroup: 999
{{- toYaml .Values.dashboard.containerSecurityContext | nindent 12 }}
{{- end }}
komalsukhani marked this conversation as resolved.
Show resolved Hide resolved
env:
## DEFAULT TYK DASHBOARD CONFIGURATION
- name: "TYK_DB_ENABLEOWNERSHIP"
Expand Down
8 changes: 8 additions & 0 deletions components/tyk-dashboard/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,14 @@ dashboard:
securityContext:
runAsUser: 1000
fsGroup: 2000
containerSecurityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all
nodeSelector: {}
tolerations: []
affinity: {}
Expand Down
10 changes: 3 additions & 7 deletions components/tyk-enterprise-portal/templates/statefulset-enterprise-portal.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,14 +49,10 @@ spec:
- image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
name: enterprise-portal-{{ .Chart.Name }}
{{- if .Values.containerSecurityContext }}
securityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all
{{- toYaml .Values.containerSecurityContext | nindent 10 }}
{{- end}}
env:
- name: PORTAL_LICENSEKEY
valueFrom:
Expand Down
8 changes: 8 additions & 0 deletions components/tyk-enterprise-portal/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,14 @@ resources: {}
securityContext:
runAsUser: 1000
fsGroup: 2000
containerSecurityContext:
komalsukhani marked this conversation as resolved.
Show resolved Hide resolved
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all
nodeSelector: {}
tolerations: []
affinity: {}
Expand Down
10 changes: 3 additions & 7 deletions components/tyk-gateway/templates/deployment-gw-repset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,14 +68,10 @@ spec:
- name: gateway-{{ .Chart.Name }}
image: "{{ .Values.gateway.image.repository }}:{{ .Values.gateway.image.tag }}"
imagePullPolicy: {{ .Values.gateway.image.pullPolicy }}
{{- if .Values.gateway.containerSecurityContext }}
securityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all
{{- toYaml .Values.gateway.containerSecurityContext | nindent 12 }}
{{- end }}
env:
- name: TYK_GW_LISTENPORT
value: "{{ .Values.global.servicePorts.gateway }}"
Expand Down
10 changes: 10 additions & 0 deletions components/tyk-gateway/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,6 +221,16 @@ gateway:
runAsUser: 1000
fsGroup: 2000

# containerSecurityContext values for gateway container
containerSecurityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all

# node labels for gateway pod assignment
nodeSelector: {}

Expand Down
10 changes: 3 additions & 7 deletions components/tyk-pump/templates/deployment-pmp.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,14 +45,10 @@ spec:
ports:
- name: tyk-pump-port
containerPort: {{ .Values.pump.containerPort }}
{{- if .Values.pump.containerSecurityContext }}
securityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all
{{- toYaml .Values.pump.containerSecurityContext | nindent 12 }}
{{- end }}
env:
# Legacy support for Redis Cluster driver. Driver dropped in v3.0.0.
- name: REDIGOCLUSTER_SHARDCOUNT
Expand Down
10 changes: 10 additions & 0 deletions components/tyk-pump/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,6 +233,16 @@ pump:
runAsUser: 1000
fsGroup: 2000

# containerSecurityContext values for pump container
containerSecurityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all

# node labels for pump pod assignment
nodeSelector: {}

Expand Down
20 changes: 20 additions & 0 deletions tyk-mdcb-data-plane/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,6 +226,16 @@ tyk-gateway:
runAsUser: 1000
fsGroup: 2000

# containerSecurityContext values for gateway container
containerSecurityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all

# node labels for gateway pod assignment
nodeSelector: {}

Expand Down Expand Up @@ -409,6 +419,16 @@ tyk-pump:
runAsUser: 1000
fsGroup: 2000

# containerSecurityContext values for pump container
containerSecurityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all

# node labels for pump pod assignment
nodeSelector: {}

Expand Down
20 changes: 20 additions & 0 deletions tyk-oss/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -209,6 +209,16 @@ tyk-gateway:
runAsUser: 1000
fsGroup: 2000

# containerSecurityContext values for gateway container
containerSecurityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all

# node labels for gateway pod assignment
nodeSelector: {}

Expand Down Expand Up @@ -372,6 +382,16 @@ tyk-pump:
runAsUser: 1000
fsGroup: 2000

# containerSecurityContext values for pump container
containerSecurityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all

# node labels for pump pod assignment
nodeSelector: {}

Expand Down
36 changes: 36 additions & 0 deletions tyk-single-dc/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,6 +277,16 @@ tyk-gateway:
runAsUser: 1000
fsGroup: 2000

# containerSecurityContext values for gateway container
containerSecurityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all

# node labels for gateway pod assignment
nodeSelector: {}

Expand Down Expand Up @@ -443,6 +453,16 @@ tyk-pump:
runAsUser: 1000
fsGroup: 2000

# containerSecurityContext values for pump container
containerSecurityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all

# node labels for pump pod assignment
nodeSelector: {}

Expand Down Expand Up @@ -594,6 +614,14 @@ tyk-dashboard:
securityContext:
runAsUser: 1000
fsGroup: 2000
containerSecurityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all
nodeSelector: {}
tolerations: []
affinity: {}
Expand Down Expand Up @@ -709,6 +737,14 @@ tyk-enterprise-portal:
securityContext:
runAsUser: 1000
fsGroup: 2000
containerSecurityContext:
komalsukhani marked this conversation as resolved.
Show resolved Hide resolved
runAsNonRoot: true
allowPrivilegeEscalation: false
privileged: false
readOnlyRootFilesystem: true
capabilities:
drop:
- all
nodeSelector: {}
tolerations: []
affinity: {}
Expand Down