Merge pull request #1034 from olegmayko/master

Add security context to deployment and statefulset
kubernetes · Jan 22, 2020 · d6677ac · d6677ac
2 parents d35e7ba + 7977a4a
commit d6677ac
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 1 deletion.
diff --git a/examples/autosharding/statefulset.yaml b/examples/autosharding/statefulset.yaml
@@ -52,6 +52,8 @@ spec:
             port: 8081
           initialDelaySeconds: 5
           timeoutSeconds: 5
+        securityContext:
+          runAsUser: 65534
       nodeSelector:
         kubernetes.io/os: linux
       serviceAccountName: kube-state-metrics

diff --git a/examples/standard/deployment.yaml b/examples/standard/deployment.yaml
@@ -37,6 +37,8 @@ spec:
             port: 8081
           initialDelaySeconds: 5
           timeoutSeconds: 5
+        securityContext:
+          runAsUser: 65534
       nodeSelector:
         kubernetes.io/os: linux
       serviceAccountName: kube-state-metrics
diff --git a/jsonnet/kube-state-metrics/kube-state-metrics.libsonnet b/jsonnet/kube-state-metrics/kube-state-metrics.libsonnet
@@ -164,7 +164,8 @@ local k = import 'ksonnet/ksonnet.beta.4/k.libsonnet';
       container.mixin.readinessProbe.httpGet.withPath('/') +
       container.mixin.readinessProbe.httpGet.withPort(8081) +
       container.mixin.readinessProbe.withInitialDelaySeconds(5) +
-      container.mixin.readinessProbe.withTimeoutSeconds(5);
+      container.mixin.readinessProbe.withTimeoutSeconds(5) +
+      container.mixin.securityContext.withRunAsUser(65534);
 
     deployment.new(ksm.name, 1, c, ksm.commonLabels) +
     deployment.mixin.metadata.withNamespace(ksm.namespace) +
@@ -236,6 +237,7 @@ local k = import 'ksonnet/ksonnet.beta.4/k.libsonnet';
                   '--pod=$(POD_NAME)',
                   '--pod-namespace=$(POD_NAMESPACE)',
                 ]) +
+                container.mixin.securityContext.withRunAsUser(65534) + 
                 container.withEnv([
                   containerEnv.new('POD_NAME') +
                   containerEnv.mixin.valueFrom.fieldRef.withFieldPath('metadata.name'),