fix: refactor security context inclusion in deployment templates and …

…update service account settings On-behalf-of: @SAP angel.kafazov@sap.com Signed-off-by: Angel Kafazov <akafazov@cst-bg.net>
openmfp · Nov 25, 2024 · 0c6af2c · 0c6af2c
1 parent 557ba35
commit 0c6af2c
Show file tree

Hide file tree

Showing 5 changed files with 24 additions and 8 deletions.
diff --git a/charts/extension-manager-operator/templates/deployment.yaml b/charts/extension-manager-operator/templates/deployment.yaml
@@ -33,9 +33,7 @@ spec:
           image: {{ .Values.image.name }}:{{ .Chart.AppVersion }}
           imagePullPolicy: {{ include "common.imagePullPolicy" . }}
           name: manager
-          securityContext:
-            runAsNonRoot: true
-            readOnlyRootFilesystem: true
+          {{ include "common.security" . | nindent 10 }}
           ports:
           - containerPort: {{ .Values.metrics.port }}
             name: metrics

diff --git a/charts/extension-manager-operator/tests/__snapshot__/deployment_test.yaml.snap b/charts/extension-manager-operator/tests/__snapshot__/deployment_test.yaml.snap
@@ -86,6 +86,7 @@ operator match the snapshot:
                 - --leader-elect
                 - --log-level=
                 - --health-probe-bind-address=:8081
+              automountServiceAccountToken: true
               image: ghcr.io/openmfp/extension-content-operator:1.0.0
               imagePullPolicy: Always
               livenessProbe:
@@ -118,6 +119,9 @@ operator match the snapshot:
               securityContext:
                 readOnlyRootFilesystem: true
                 runAsNonRoot: true
+                seccompProfile:
+                  type: RuntimeDefault
+              serviceAccountName: extension-manager-operator
               startupProbe:
                 failureThreshold: 30
                 httpGet:

diff --git a/charts/portal/templates/deploy.yaml b/charts/portal/templates/deploy.yaml
@@ -27,8 +27,7 @@ spec:
       - name: {{ include "common.entity.name" . }}
         image: {{ .Values.image.name }}:{{ .Chart.AppVersion }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
-        securityContext:
-          readOnlyRootFilesystem: true
+        {{ include "common.security" . | nindent 8 }}
         env:
         - name: HTTP_PROTOCOL
           value: {{ .Values.http.protocol }}

diff --git a/charts/portal/tests/__snapshot__/deploy_test.yaml.snap b/charts/portal/tests/__snapshot__/deploy_test.yaml.snap
@@ -21,7 +21,8 @@ matches the snapshot:
             app: portal
         spec:
           containers:
-            - env:
+            - automountServiceAccountToken: true
+              env:
                 - name: HTTP_PROTOCOL
                   value: https
                 - name: OIDC_CLIENT_ID_PORTAL
@@ -64,6 +65,10 @@ matches the snapshot:
                   memory: 50Mi
               securityContext:
                 readOnlyRootFilesystem: true
+                runAsNonRoot: true
+                seccompProfile:
+                  type: RuntimeDefault
+              serviceAccountName: portal
           securityContext:
             fsGroup: 2000
             runAsGroup: 3000

diff --git a/charts/portal/tests/__snapshot__/istio_test.yaml.snap b/charts/portal/tests/__snapshot__/istio_test.yaml.snap
@@ -21,7 +21,8 @@ matches the snapshot:
             app: portal
         spec:
           containers:
-            - env:
+            - automountServiceAccountToken: true
+              env:
                 - name: HTTP_PROTOCOL
                   value: https
                 - name: OIDC_CLIENT_ID_PORTAL
@@ -64,6 +65,10 @@ matches the snapshot:
                   memory: 50Mi
               securityContext:
                 readOnlyRootFilesystem: true
+                runAsNonRoot: true
+                seccompProfile:
+                  type: RuntimeDefault
+              serviceAccountName: portal
           securityContext:
             fsGroup: 2000
             runAsGroup: 3000
@@ -160,7 +165,8 @@ matches the snapshot with istio disabled:
             app: portal
         spec:
           containers:
-            - env:
+            - automountServiceAccountToken: true
+              env:
                 - name: HTTP_PROTOCOL
                   value: https
                 - name: OIDC_CLIENT_ID_PORTAL
@@ -203,6 +209,10 @@ matches the snapshot with istio disabled:
                   memory: 50Mi
               securityContext:
                 readOnlyRootFilesystem: true
+                runAsNonRoot: true
+                seccompProfile:
+                  type: RuntimeDefault
+              serviceAccountName: portal
           securityContext:
             fsGroup: 2000
             runAsGroup: 3000