Merge pull request #22 from Cray-HPE/CASMINST-3548

Fixes CASMINST-3548: avoid istio from injecting fsGroup 1337 to tls
Cray-HPE · Nov 12, 2021 · 641b68e · 641b68e
2 parents 7561eb0 + 03b9222
commit 641b68e
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 4 deletions.
diff --git a/kubernetes/cray-istio-deploy/templates/istiooperator.yaml b/kubernetes/cray-istio-deploy/templates/istiooperator.yaml
@@ -33,6 +33,9 @@ spec:
     pilot:
       enabled: true
       k8s:
+        env:
+        - name: ENABLE_LEGACY_FSGROUP_INJECTION
+          value: "false"
         resources:
           requests:
             {{- if .Values.pilot.resources.requests.cpu }}

diff --git a/kubernetes/cray-istio-deploy/tests/istiooperator_test.yaml b/kubernetes/cray-istio-deploy/tests/istiooperator_test.yaml
@@ -11,13 +11,13 @@ tests:
           pattern: cray-istio$
       - equal:
           path: spec.components.pilot.hub
-          value: dtr.dev.cray.com/cray
+          value: artifactory.algol60.net/csm-docker/stable/istio
       - equal:
           path: spec.components.pilot.tag
-          value: 1.7.8-cray1-distroless
+          value: 1.8.6-cray1-distroless
       - equal:
           path: spec.hub
-          value: dtr.dev.cray.com/cray
+          value: artifactory.algol60.net/csm-docker/stable/istio
       - equal:
           path: spec.tag
-          value: 1.7.8-cray1-distroless
+          value: 1.8.6-cray1-distroless