Ugh put the security context back

nycmeshnet · Aug 11, 2024 · 462db19 · 462db19
1 parent b6c7980
commit 462db19
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 1 deletion.
diff --git a/infra/helm/meshdb/charts/celery/templates/deployment.yaml b/infra/helm/meshdb/charts/celery/templates/deployment.yaml
@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "celery.fullname" . }}
+  namespace: meshdb
   labels:
     {{- include "celery.labels" . | nindent 4 }}
 spec:
@@ -27,11 +28,17 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
         {{- range .Values.containers }}
         - name: {{ .name }}
+          securityContext:
+            {{- toYaml $.Values.securityContext | nindent 12 }}
           image: "{{ $.Values.image.repository }}:{{ $.Values.image.tag | default $.Chart.AppVersion }}"
           imagePullPolicy: {{ $.Values.image.pullPolicy }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
           entrypoint: {{ .entrypoint }}
           envFrom:
           - configMapRef:

diff --git a/infra/helm/meshdb/charts/celery/values.yaml b/infra/helm/meshdb/charts/celery/values.yaml
@@ -20,10 +20,21 @@ serviceAccount:
 podAnnotations: {}
 podLabels: {}
 
+podSecurityContext:
+  seccompProfile:
+    type: RuntimeDefault
+securityContext: {}
+
 ingress:
   enabled: false
 
-resources: {}
+resources:
+  limits:
+    cpu: 100m
+    memory: 128Mi
+  #requests:
+  #  cpu: 100m
+  #  memory: 128Mi
 
 containers:
   - name: celery-beat