moved app armor to _helpers

Author: yairsappir

wiz-outpost-lite/templates/_helpers.tpl

@@ -102,6 +102,13 @@ container-registry -> outpost-lite-runner-container-registry
 {{- $values = merge $values $.Values.openshiftOverrides }}
 {{- end }}
 
+{{/* Add apparmor pod annotation if given */}}
+{{- if ne $values.podAnnotationsApparmor "" }}
+{{- $key := printf "container.apparmor.security.beta.kubernetes.io/%s-%s" $.Chart.Name $runner }}
+{{- $appArmor := dict $key $values.podAnnotationsApparmor }}
+{{- $values = merge $values (dict "podAnnotations" $appArmor) }}
+{{- end }}
+
 {{- if hasKey $values "containerSecurityContextOverride"}}
 {{- $values = set $values "containerSecurityContext" $values.containerSecurityContextOverride }}
 {{- end }}

wiz-outpost-lite/templates/deployment.yaml

@@ -18,9 +18,6 @@ spec:
         {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
-        {{- if .Values.podAnnotationsApparmor.enabled }}
-        container.apparmor.security.beta.kubernetes.io/{{ printf "%s-%s" .Chart.Name .runner }}: unconfined
-        {{- end }}
       labels:
         {{- include "wiz-outpost-lite.selectorLabels" . | nindent 8 }}
         {{- with .Values.labels }}

wiz-outpost-lite/values.yaml

@@ -33,8 +33,7 @@ fullnameOverride: ""
 
 podAnnotations: {}
 
-podAnnotationsApparmor:
-  enabled: false
+podAnnotationsApparmor: ""
 
 resources:
   limits:
@@ -94,8 +93,7 @@ modules:
     enabled: false
     image:
       name: outpost-lite-runner-vcs
-    podAnnotationsApparmor:
-      enabled: true
+    podAnnotationsApparmor: unconfined
     containerSecurityContext:
       capabilities:
         add:
@@ -104,8 +102,7 @@ modules:
         type: spc_t
   container-registry:
     enabled: false
-    podAnnotationsApparmor:
-      enabled: true
+    podAnnotationsApparmor: unconfined
     containerSecurityContext:
       capabilities:
         add:
@@ -114,8 +111,6 @@ modules:
         type: spc_t
   remediation:
     enabled: false
-    podAnnotationsApparmor:
-      enabled: false
     serviceAccount:
       create: true
     podSecurityContext: