Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Drop all capabilities for containers and add image pull policy #903

Merged
merged 7 commits into from
Jun 7, 2024
+34 −24
Merged

Drop all capabilities for containers and add image pull policy #903

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
1582639
fixing shieldguard issues
rashmichandrashekar May 30, 2024
28c03a1
update permissions
rashmichandrashekar Jun 1, 2024
ede6e64
recursive
rashmichandrashekar Jun 2, 2024
7912bc6
shieldguard changes
rashmichandrashekar Jun 4, 2024
53daf42
cleaning up
rashmichandrashekar Jun 5, 2024
3799f17
remove branch
rashmichandrashekar Jun 5, 2024
0f6b04e
clean up
rashmichandrashekar Jun 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 17 additions & 17 deletions ...ector/deploy/addon-chart/azure-monitor-metrics-addon/templates/ama-metrics-daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,11 @@ spec:
value: "{{ .Values.AzureMonitorMetrics.OpenTelemetryMetricsPort }}"
securityContext:
privileged: false
capabilities:
drop:
- ALL
add:
- DAC_OVERRIDE
volumeMounts:
- mountPath: /etc/config/settings
name: settings-vol-config
Expand All @@ -152,9 +157,6 @@ spec:
- name: host-log-containers
readOnly: true
mountPath: /var/log/containers
- name: host-log-pods
readOnly: true
mountPath: /var/log/pods
- mountPath: /anchors/mariner
name: anchors-mariner
readOnly: true
Expand Down Expand Up @@ -248,7 +250,7 @@ spec:
- operator: "Exists"
effect: "NoExecute"
- operator: "Exists"
effect: "PreferNoSchedule"
effect: "PreferNoSchedule"
{{- end }}
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
Expand Down Expand Up @@ -284,9 +286,6 @@ spec:
- name: host-log-containers
hostPath:
path: /var/log/containers
- name: host-log-pods
hostPath:
path: /var/log/pods
- name: anchors-mariner
hostPath:
path: /etc/pki/ca-trust/anchors/
Expand Down Expand Up @@ -412,6 +411,11 @@ spec:
value: "{{ .Values.AzureMonitorMetrics.OpenTelemetryMetricsPort }}"
securityContext:
privileged: false
capabilities:
drop:
- ALL
add:
- DAC_OVERRIDE
volumeMounts:
- mountPath: /etc/config/settings
name: settings-vol-config
Expand All @@ -425,9 +429,6 @@ spec:
- name: host-log-containers
readOnly: true
mountPath: /var/log/containers
- name: host-log-pods
readOnly: true
mountPath: /var/log/pods
livenessProbe:
exec:
command:
Expand All @@ -447,7 +448,7 @@ spec:
- --token-server-listening-port=7777
- --health-server-listening-port=9999
image: "mcr.microsoft.com{{ .Values.AzureMonitorMetrics.AddonTokenAdapter.ImageRepositoryWin }}:{{ .Values.AzureMonitorMetrics.AddonTokenAdapter.ImageTagWin }}"
imagePullPolicy: Always
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
path: /healthz
Expand All @@ -461,9 +462,11 @@ spec:
cpu: 100m
memory: 100Mi
securityContext:
capabilities:
add:
- NET_ADMIN
capabilities:
drop:
- ALL
add:
- NET_ADMIN
vishiy marked this conversation as resolved.
Show resolved Hide resolved
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
Expand Down Expand Up @@ -501,7 +504,4 @@ spec:
secret:
secretName: ama-metrics-mtls-secret
optional: true
- name: host-log-pods
hostPath:
path: /var/log/pods
{{- end }}
11 changes: 5 additions & 6 deletions ...ctor/deploy/addon-chart/azure-monitor-metrics-addon/templates/ama-metrics-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,11 @@ spec:
value: "true" # only supported value is the string "true"
securityContext:
privileged: false
capabilities:
drop:
- ALL
add:
- DAC_OVERRIDE
volumeMounts:
- mountPath: /etc/config/settings
name: settings-vol-config
Expand All @@ -176,9 +181,6 @@ spec:
- name: host-log-containers
readOnly: true
mountPath: /var/log/containers
- name: host-log-pods
readOnly: true
mountPath: /var/log/pods
- mountPath: /anchors/mariner
name: anchors-mariner
readOnly: true
Expand Down Expand Up @@ -320,9 +322,6 @@ spec:
- name: host-log-containers
hostPath:
path: /var/log/containers
- name: host-log-pods
hostPath:
path: /var/log/pods
- name: anchors-mariner
hostPath:
path: /etc/pki/ca-trust/anchors/
Expand Down
4 changes: 4 additions & 0 deletions .../deploy/addon-chart/azure-monitor-metrics-addon/templates/ama-metrics-ksm-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,10 @@ spec:
requests:
cpu: 5m
memory: 50Mi
securityContext:
capabilities:
drop:
- ALL
ports:
- containerPort: 8080
name: "http"
Expand Down
9 changes: 8 additions & 1 deletion ...deploy/addon-chart/azure-monitor-metrics-addon/templates/ama-metrics-targetallocator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,10 @@ spec:
value: {{ .Values.AzureMonitorMetrics.ImageTagTargetAllocator }}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
securityContext:
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /conf
name: ta-config-shared
Expand Down Expand Up @@ -151,6 +155,10 @@ spec:
readOnly: true
- mountPath: /ta-configuration
name: ta-config-shared
securityContext:
capabilities:
drop:
- ALL
livenessProbe:
exec:
command:
Expand All @@ -164,7 +172,6 @@ spec:
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
serviceAccount: ama-metrics-serviceaccount
serviceAccountName: ama-metrics-serviceaccount
terminationGracePeriodSeconds: 30
Expand Down
Loading