From 683c80dd0fec68ca4741e05543bc388bad05668d Mon Sep 17 00:00:00 2001 From: Carlos Rodriguez Hernandez Date: Tue, 4 Sep 2018 13:48:30 +0000 Subject: [PATCH] Change user in securityContext --- bitnami/nginx-ingress-controller/README.md | 3 +++ .../templates/controller-daemonset.yaml | 4 ++-- .../templates/controller-deployment.yaml | 4 ++-- bitnami/nginx-ingress-controller/values.yaml | 8 ++++++++ 4 files changed, 15 insertions(+), 4 deletions(-) diff --git a/bitnami/nginx-ingress-controller/README.md b/bitnami/nginx-ingress-controller/README.md index c5c7c469d..7ee7e237d 100644 --- a/bitnami/nginx-ingress-controller/README.md +++ b/bitnami/nginx-ingress-controller/README.md @@ -151,6 +151,9 @@ Parameter | Description | Default `defaultBackend.service.type` | type of default backend service to create | `ClusterIP` `imagePullSecrets` | name of Secret resource containing private registry credentials | `nil` `rbac.create` | if `true`, create & use RBAC resources | `true` +`securityContext.enabled` | Enable security context | `true` +`securityContext.fsGroup` | Group ID for the container | `1001` +`securityContext.runAsUser` | User ID for the container | `1001` `podSecurityPolicy.enabled` | if `true`, create & use Pod Security Policy resources | `false` `serviceAccount.create` | if `true`, create a service account | `` `serviceAccount.name` | The name of the service account to use. If not set and `create` is `true`, a name is generated using the fullname template. | `` diff --git a/bitnami/nginx-ingress-controller/templates/controller-daemonset.yaml b/bitnami/nginx-ingress-controller/templates/controller-daemonset.yaml index 8c527f528..052318f3b 100644 --- a/bitnami/nginx-ingress-controller/templates/controller-daemonset.yaml +++ b/bitnami/nginx-ingress-controller/templates/controller-daemonset.yaml @@ -85,8 +85,8 @@ spec: - ALL add: - NET_BIND_SERVICE - # www-data -> 33 - runAsUser: 33 + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} {{- end }} env: - name: POD_NAME diff --git a/bitnami/nginx-ingress-controller/templates/controller-deployment.yaml b/bitnami/nginx-ingress-controller/templates/controller-deployment.yaml index 790c11a25..85d944403 100644 --- a/bitnami/nginx-ingress-controller/templates/controller-deployment.yaml +++ b/bitnami/nginx-ingress-controller/templates/controller-deployment.yaml @@ -85,8 +85,8 @@ spec: - ALL add: - NET_BIND_SERVICE - # www-data -> 33 - runAsUser: 33 + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} {{- end }} env: - name: POD_NAME diff --git a/bitnami/nginx-ingress-controller/values.yaml b/bitnami/nginx-ingress-controller/values.yaml index f976cf6d2..de708e8a3 100644 --- a/bitnami/nginx-ingress-controller/values.yaml +++ b/bitnami/nginx-ingress-controller/values.yaml @@ -355,6 +355,14 @@ defaultBackend: rbac: create: true +## Kubernetes Security Context +## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +## +securityContext: + enabled: true + fsGroup: 1001 + runAsUser: 1001 + # If true, create & use Pod Security Policy resources # https://kubernetes.io/docs/concepts/policy/pod-security-policy/ podSecurityPolicy: