diff --git a/charts/steadybit-extension-datadog/Chart.yaml b/charts/steadybit-extension-datadog/Chart.yaml index 6309472..21b7a87 100644 --- a/charts/steadybit-extension-datadog/Chart.yaml +++ b/charts/steadybit-extension-datadog/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: steadybit-extension-datadog description: Steadybit Kubernetes extension Helm chart for Datadog. -version: 1.5.7 +version: 1.5.8 appVersion: v1.8.8 home: https://www.steadybit.com/ icon: https://steadybit-website-assets.s3.amazonaws.com/logo-symbol-transparent.png diff --git a/charts/steadybit-extension-datadog/templates/deployment.yaml b/charts/steadybit-extension-datadog/templates/deployment.yaml index 4314f15..d2d446a 100644 --- a/charts/steadybit-extension-datadog/templates/deployment.yaml +++ b/charts/steadybit-extension-datadog/templates/deployment.yaml @@ -117,15 +117,10 @@ spec: httpGet: path: /health/readiness port: 8091 + {{- with .Values.containerSecurityContext }} securityContext: - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 10000 - runAsGroup: 10000 - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL + {{- toYaml . | nindent 12 }} + {{- end }} volumes: {{- include "extensionlib.deployment.volumes" (list .) | nindent 8 }} serviceAccountName: {{ .Values.serviceAccount.name }} diff --git a/charts/steadybit-extension-datadog/tests/__snapshot__/deployment_test.yaml.snap b/charts/steadybit-extension-datadog/tests/__snapshot__/deployment_test.yaml.snap index e54dc5f..5028efd 100644 --- a/charts/steadybit-extension-datadog/tests/__snapshot__/deployment_test.yaml.snap +++ b/charts/steadybit-extension-datadog/tests/__snapshot__/deployment_test.yaml.snap @@ -88,10 +88,11 @@ manifest should match snapshot using podAnnotations and Labels: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-datadog volumes: null manifest should match snapshot with TLS: @@ -186,13 +187,14 @@ manifest should match snapshot with TLS: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: - mountPath: /etc/extension/certificates/server-cert name: certificate-server-cert readOnly: true + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-datadog volumes: - name: certificate-server-cert @@ -294,10 +296,11 @@ manifest should match snapshot with extra env vars: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-datadog volumes: null manifest should match snapshot with extra labels: @@ -390,10 +393,11 @@ manifest should match snapshot with extra labels: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-datadog volumes: null manifest should match snapshot with mock server: @@ -488,10 +492,11 @@ manifest should match snapshot with mock server: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-datadog volumes: null manifest should match snapshot with mutual TLS: @@ -588,9 +593,6 @@ manifest should match snapshot with mutual TLS: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: - mountPath: /etc/extension/certificates/client-cert-a name: certificate-client-cert-a @@ -598,6 +600,10 @@ manifest should match snapshot with mutual TLS: - mountPath: /etc/extension/certificates/server-cert name: certificate-server-cert readOnly: true + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-datadog volumes: - name: certificate-client-cert-a @@ -702,10 +708,11 @@ manifest should match snapshot with mutual TLS using containerPaths: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-datadog volumes: null manifest should match snapshot with podSecurityContext: @@ -796,12 +803,12 @@ manifest should match snapshot with podSecurityContext: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null securityContext: + runAsNonRoot: true runAsUser: 2222 + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-datadog volumes: null manifest should match snapshot with priority class: @@ -892,11 +899,12 @@ manifest should match snapshot with priority class: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null priorityClassName: my-priority-class + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-datadog volumes: null manifest should match snapshot without TLS: @@ -987,9 +995,10 @@ manifest should match snapshot without TLS: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-datadog volumes: null diff --git a/charts/steadybit-extension-datadog/values.yaml b/charts/steadybit-extension-datadog/values.yaml index 0d59ea1..1a46ecd 100644 --- a/charts/steadybit-extension-datadog/values.yaml +++ b/charts/steadybit-extension-datadog/values.yaml @@ -118,7 +118,18 @@ affinity: {} priorityClassName: null # podSecurityContext -- SecurityContext to apply to the pod. -podSecurityContext: {} +podSecurityContext: + seccompProfile: + type: RuntimeDefault + runAsNonRoot: true + +# containerSecurityContext -- SecurityContext to apply to the container. +containerSecurityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL # extraEnv -- Array with extra environment variables to add to the container # e.g: