diff --git a/charts/pg-operator/templates/deployment.yaml b/charts/pg-operator/templates/deployment.yaml index 86b2cc89..07cc65a1 100644 --- a/charts/pg-operator/templates/deployment.yaml +++ b/charts/pg-operator/templates/deployment.yaml @@ -73,6 +73,7 @@ spec: path: /metrics port: metrics scheme: HTTP + {{- with .Values.containerSecurityContext }} securityContext: allowPrivilegeEscalation: false capabilities: @@ -80,6 +81,7 @@ spec: - ALL readOnlyRootFilesystem: true runAsNonRoot: true + {{- end }} resources: {{- toYaml .Values.resources | nindent 12 }} {{- with .Values.nodeSelector }} diff --git a/charts/pg-operator/values.yaml b/charts/pg-operator/values.yaml index 662a068e..6fa9dca5 100644 --- a/charts/pg-operator/values.yaml +++ b/charts/pg-operator/values.yaml @@ -31,6 +31,8 @@ resources: cpu: 100m memory: 20Mi +containerSecurityContext: {} + nodeSelector: {} tolerations: [] diff --git a/charts/psmdb-operator/templates/deployment.yaml b/charts/psmdb-operator/templates/deployment.yaml index 41f26c26..70677143 100644 --- a/charts/psmdb-operator/templates/deployment.yaml +++ b/charts/psmdb-operator/templates/deployment.yaml @@ -32,16 +32,20 @@ spec: {{- end }} spec: serviceAccountName: {{ include "psmdb-operator.fullname" . }} + {{- with .Values.podSecurityContext }} securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- end }} {{- with .Values.imagePullSecrets }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} containers: - name: {{ .Chart.Name }} + {{- with .Values.securityContext }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} + {{- end }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" imagePullPolicy: {{ .Values.image.pullPolicy }} ports: @@ -53,11 +57,13 @@ spec: name: health command: - percona-server-mongodb-operator + {{- with .Values.securityContext }} {{- if .Values.securityContext.readOnlyRootFilesystem }} volumeMounts: - name: tmpdir mountPath: /tmp {{- end }} + {{- end }} env: - name: LOG_STRUCTURED value: "{{ .Values.logStructured }}" @@ -101,8 +107,10 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} + {{- with .Values.securityContext }} {{- if .Values.securityContext.readOnlyRootFilesystem }} volumes: - name: tmpdir emptyDir: {} {{- end }} + {{- end }}