connect-helm-charts
connect-helm-charts copied to clipboard
Added configurable `securityContext` and follow `restricted` PSS
Hello! We want to be able to control the securityContext of the 1Password Connect pods to follow our own set of guidelines. Such as we want our pods to use a specific UID.
I've also changed it to follow the restricted Pod Security Standard by default, so people can use the 1Password Connect operator when they have the pod-security.kubernetes.io/enforce: restricted namespace label.
Changes:
- Added
securityContextsettings to connect chart - Added
securityContextsettings to secrets-injector chart - Changed
securityContextto followrestrictedPod Security Standard by default - Added
pre-upgradeto secrets-injector to also update on upgrades - Added
emptyDirfor/tmpto secrets-injector as I'm settingsecurityContext.readOnlyRootFilesystem: trueand the glog library requires it to write logs into (changing-alsologtostderrto-logtostderrdidn't help)
I've tested this by installing into a test cluster and running the acceptance tests.
Closes #192
Anything I'm missing or that I can help with to get this PR reviewed and merged?
We also need this, as several security policies currently prevent pod creation.
@applejag you probably need to rebase your changed again @edif2008 bump :D
Could you kindly review this PR? It's a requirement for most of the Kubernetes clusters.
bump: @bo0tzz @edif2008 @volodymyrZotov cc: @applejag
Why did you tag me @parsa97? I have no permissions on this repo.
Hi, we could also use this change to actually make use of the application.
bump: @edif2008 @volodymyrZotov