Merge pull request #6366 from ministryofjustice/fix/k8s-deploy-alerts

Fix: K8s deploy alerts
ministryofjustice · Feb 15, 2024 · 2270678 · 2270678
2 parents a4ad139 + ab0776d
commit 2270678
Show file tree

Hide file tree

Showing 12 changed files with 84 additions and 0 deletions.
diff --git a/helm_deploy/apply-for-legal-aid/templates/cronjob-admin-report.yaml b/helm_deploy/apply-for-legal-aid/templates/cronjob-admin-report.yaml
@@ -34,4 +34,11 @@ spec:
               requests:
                 cpu: 100m
                 memory: 1024Mi
+            securityContext:
+              runAsNonRoot: true
+              allowPrivilegeEscalation: false
+              seccompProfile:
+                type: RuntimeDefault
+              capabilities:
+                drop: [ "ALL" ]
           restartPolicy: Never
diff --git a/helm_deploy/apply-for-legal-aid/templates/cronjob-deliver-scheduled-mail.yaml b/helm_deploy/apply-for-legal-aid/templates/cronjob-deliver-scheduled-mail.yaml
@@ -31,4 +31,11 @@ spec:
               requests:
                 cpu: 100m
                 memory: 128Mi
+            securityContext:
+              runAsNonRoot: true
+              allowPrivilegeEscalation: false
+              seccompProfile:
+                type: RuntimeDefault
+              capabilities:
+                drop: [ "ALL" ]
           restartPolicy: Never
diff --git a/helm_deploy/apply-for-legal-aid/templates/cronjob-destroy-purgeable.yaml b/helm_deploy/apply-for-legal-aid/templates/cronjob-destroy-purgeable.yaml
@@ -34,4 +34,11 @@ spec:
               requests:
                 cpu: 100m
                 memory: 256Mi
+            securityContext:
+              runAsNonRoot: true
+              allowPrivilegeEscalation: false
+              seccompProfile:
+                type: RuntimeDefault
+              capabilities:
+                drop: [ "ALL" ]
           restartPolicy: Never
diff --git a/helm_deploy/apply-for-legal-aid/templates/cronjob-export-digest.yaml b/helm_deploy/apply-for-legal-aid/templates/cronjob-export-digest.yaml
@@ -34,4 +34,11 @@ spec:
               requests:
                 cpu: 400m
                 memory: 4096Mi
+            securityContext:
+              runAsNonRoot: true
+              allowPrivilegeEscalation: false
+              seccompProfile:
+                type: RuntimeDefault
+              capabilities:
+                drop: [ "ALL" ]
           restartPolicy: Never
diff --git a/helm_deploy/apply-for-legal-aid/templates/cronjob-extract-digest.yaml b/helm_deploy/apply-for-legal-aid/templates/cronjob-extract-digest.yaml
@@ -34,4 +34,11 @@ spec:
               requests:
                 cpu: 100m
                 memory: 256Mi
+            securityContext:
+              runAsNonRoot: true
+              allowPrivilegeEscalation: false
+              seccompProfile:
+                type: RuntimeDefault
+              capabilities:
+                drop: [ "ALL" ]
           restartPolicy: Never
diff --git a/helm_deploy/apply-for-legal-aid/templates/cronjob-mark-purgeable.yaml b/helm_deploy/apply-for-legal-aid/templates/cronjob-mark-purgeable.yaml
@@ -34,4 +34,11 @@ spec:
               requests:
                 cpu: 100m
                 memory: 256Mi
+            securityContext:
+              runAsNonRoot: true
+              allowPrivilegeEscalation: false
+              seccompProfile:
+                type: RuntimeDefault
+              capabilities:
+                drop: [ "ALL" ]
           restartPolicy: Never
diff --git a/helm_deploy/apply-for-legal-aid/templates/cronjob-metrics.yaml b/helm_deploy/apply-for-legal-aid/templates/cronjob-metrics.yaml
@@ -32,4 +32,11 @@ spec:
               requests:
                 cpu: 100m
                 memory: 128Mi
+            securityContext:
+              runAsNonRoot: true
+              allowPrivilegeEscalation: false
+              seccompProfile:
+                type: RuntimeDefault
+              capabilities:
+                drop: [ "ALL" ]
           restartPolicy: Never
diff --git a/helm_deploy/apply-for-legal-aid/templates/cronjob-reset-dashboard-overnight.yaml b/helm_deploy/apply-for-legal-aid/templates/cronjob-reset-dashboard-overnight.yaml
@@ -31,4 +31,11 @@ spec:
               requests:
                 cpu: 100m
                 memory: 128Mi
+            securityContext:
+              runAsNonRoot: true
+              allowPrivilegeEscalation: false
+              seccompProfile:
+                type: RuntimeDefault
+              capabilities:
+                drop: [ "ALL" ]
           restartPolicy: Never
diff --git a/helm_deploy/apply-for-legal-aid/templates/deployment_metrics.yaml b/helm_deploy/apply-for-legal-aid/templates/deployment_metrics.yaml
@@ -51,3 +51,10 @@ spec:
             requests:
               cpu: 10m
               memory: 64Mi
+          securityContext:
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
+            capabilities:
+              drop: [ "ALL" ]
diff --git a/helm_deploy/apply-for-legal-aid/templates/deployment_web.yaml b/helm_deploy/apply-for-legal-aid/templates/deployment_web.yaml
@@ -41,6 +41,13 @@ spec:
             requests:
               cpu: 10m
               memory: 1Gi
+          securityContext:
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
+            capabilities:
+              drop: [ "ALL" ]
         - name: web
           image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
           imagePullPolicy: IfNotPresent
@@ -65,6 +72,13 @@ spec:
             preStop:
               exec:
                 command: [ "sh", "-c", "sleep 30" ] # Workaround for occasional lost requests - see https://github.com/puma/puma/blob/master/docs/kubernetes.md#running-puma-in-kubernetes
+          securityContext:
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
+            capabilities:
+              drop: [ "ALL" ]
           resources:
             limits:
               cpu: 1000m

diff --git a/helm_deploy/apply-for-legal-aid/templates/deployment_worker.yaml b/helm_deploy/apply-for-legal-aid/templates/deployment_worker.yaml
@@ -31,6 +31,13 @@ spec:
           imagePullPolicy: IfNotPresent
           command: ['bundle', 'exec', 'sidekiq']
 {{ include "apply-for-legal-aid.envs" . | nindent 10 }}
+          securityContext:
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
+            capabilities:
+              drop: [ "ALL" ]
           resources:
             limits:
               cpu: 500m

diff --git a/helm_deploy/apply-for-legal-aid/values-uat.yaml b/helm_deploy/apply-for-legal-aid/values-uat.yaml