mirror of
https://github.com/bitnami/charts.git
synced 2026-08-10 14:15:55 +08:00
[bitnami/multus-cni] feat: ✨ 🔒 Add readOnlyRootFilesystem support (#23983)
Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
@@ -29,4 +29,4 @@ maintainers:
|
||||
name: multus-cni
|
||||
sources:
|
||||
- https://github.com/bitnami/charts/tree/main/bitnami/multus-cni
|
||||
version: 1.7.2
|
||||
version: 1.8.0
|
||||
|
||||
@@ -80,86 +80,90 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
|
||||
### Multus CNI parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
|
||||
| `image.registry` | Multus CNI image registry | `REGISTRY_NAME` |
|
||||
| `image.repository` | Multus CNI Image name | `REPOSITORY_NAME/multus-cni` |
|
||||
| `image.digest` | Multus CNI image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
|
||||
| `image.pullPolicy` | Multus CNI image pull policy | `IfNotPresent` |
|
||||
| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` |
|
||||
| `image.debug` | Specify if debug logs should be enabled | `false` |
|
||||
| `CNIVersion` | CNI version | `0.3.0` |
|
||||
| `hostCNIBinDir` | CNI binary dir in the host machine to mount | `/opt/cni/bin` |
|
||||
| `hostCNINetDir` | CNI net.d dir in the host machine to mount | `/etc/cni/net.d` |
|
||||
| `CNIMountPath` | Path inside the container to mount the CNI dirs | `/bitnami/multus-cni/host` |
|
||||
| `command` | Override default container command (useful when using custom images) | `[]` |
|
||||
| `args` | Override default container args (useful when using custom images) | `[]` |
|
||||
| `updateStrategy.type` | Update strategy - only really applicable for deployments with RWO PVs attached | `RollingUpdate` |
|
||||
| `priorityClassName` | Multus CNI pods' priorityClassName | `""` |
|
||||
| `schedulerName` | Name of the k8s scheduler (other than default) | `""` |
|
||||
| `topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` |
|
||||
| `automountServiceAccountToken` | Mount Service Account token in pod | `true` |
|
||||
| `hostAliases` | Add deployment host aliases | `[]` |
|
||||
| `extraEnvVars` | Extra environment variables | `[]` |
|
||||
| `extraEnvVarsCM` | ConfigMap containing extra env vars | `""` |
|
||||
| `extraEnvVarsSecret` | Secret containing extra env vars (in case of sensitive data) | `""` |
|
||||
| `extraVolumes` | Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` | `[]` |
|
||||
| `extraVolumeMounts` | Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. | `[]` |
|
||||
| `initContainers` | Add additional init containers to the pod (evaluated as a template) | `[]` |
|
||||
| `sidecars` | Attach additional containers to the pod (evaluated as a template) | `[]` |
|
||||
| `tolerations` | Tolerations for pod assignment | `[]` |
|
||||
| `networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
|
||||
| `networkPolicy.kubeAPIServerPorts` | List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security) | `[]` |
|
||||
| `networkPolicy.allowExternal` | Don't require server label for connections | `true` |
|
||||
| `networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolice | `[]` |
|
||||
| `networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` |
|
||||
| `nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `nodeAffinityPreset.key` | Node label key to match Ignored if `affinity` is set. | `""` |
|
||||
| `nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set. | `[]` |
|
||||
| `affinity` | Affinity for pod assignment | `{}` |
|
||||
| `nodeSelector` | Node labels for pod assignment. Evaluated as a template. | `{}` |
|
||||
| `resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). | `none` |
|
||||
| `resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `podSecurityContext.enabled` | Enable Multus CNI pods' Security Context | `true` |
|
||||
| `podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` |
|
||||
| `podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` |
|
||||
| `podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
|
||||
| `podSecurityContext.fsGroup` | Multus CNI pods' group ID | `0` |
|
||||
| `containerSecurityContext.enabled` | Enable Multus CNI containers' Security Context | `true` |
|
||||
| `containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
|
||||
| `containerSecurityContext.runAsUser` | Multus CNI containers' Security Context | `0` |
|
||||
| `containerSecurityContext.runAsNonRoot` | Set Multus CNI container's Security Context runAsNonRoot | `false` |
|
||||
| `containerSecurityContext.privileged` | Set Multus CNI container's Security Context privileged | `true` |
|
||||
| `containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
|
||||
| `startupProbe.enabled` | Enable startupProbe | `false` |
|
||||
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` |
|
||||
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
||||
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
|
||||
| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `5` |
|
||||
| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
|
||||
| `livenessProbe.enabled` | Enable livenessProbe | `true` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` |
|
||||
| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
|
||||
| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` |
|
||||
| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `readinessProbe.enabled` | Enable readinessProbe | `true` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||
| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
|
||||
| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` |
|
||||
| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `customStartupProbe` | Override default startup probe | `{}` |
|
||||
| `customLivenessProbe` | Override default liveness probe | `{}` |
|
||||
| `customReadinessProbe` | Override default readiness probe | `{}` |
|
||||
| `lifecycleHooks` | LifecycleHook to set additional configuration at startup Evaluated as a template | `{}` |
|
||||
| `podAnnotations` | Pod annotations | `{}` |
|
||||
| `podLabels` | Add additional labels to the pod (evaluated as a template) | `{}` |
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
|
||||
| `image.registry` | Multus CNI image registry | `REGISTRY_NAME` |
|
||||
| `image.repository` | Multus CNI Image name | `REPOSITORY_NAME/multus-cni` |
|
||||
| `image.digest` | Multus CNI image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
|
||||
| `image.pullPolicy` | Multus CNI image pull policy | `IfNotPresent` |
|
||||
| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` |
|
||||
| `image.debug` | Specify if debug logs should be enabled | `false` |
|
||||
| `CNIVersion` | CNI version | `0.3.0` |
|
||||
| `hostCNIBinDir` | CNI binary dir in the host machine to mount | `/opt/cni/bin` |
|
||||
| `hostCNINetDir` | CNI net.d dir in the host machine to mount | `/etc/cni/net.d` |
|
||||
| `CNIMountPath` | Path inside the container to mount the CNI dirs | `/bitnami/multus-cni/host` |
|
||||
| `command` | Override default container command (useful when using custom images) | `[]` |
|
||||
| `args` | Override default container args (useful when using custom images) | `[]` |
|
||||
| `updateStrategy.type` | Update strategy - only really applicable for deployments with RWO PVs attached | `RollingUpdate` |
|
||||
| `priorityClassName` | Multus CNI pods' priorityClassName | `""` |
|
||||
| `schedulerName` | Name of the k8s scheduler (other than default) | `""` |
|
||||
| `topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` |
|
||||
| `automountServiceAccountToken` | Mount Service Account token in pod | `true` |
|
||||
| `hostAliases` | Add deployment host aliases | `[]` |
|
||||
| `extraEnvVars` | Extra environment variables | `[]` |
|
||||
| `extraEnvVarsCM` | ConfigMap containing extra env vars | `""` |
|
||||
| `extraEnvVarsSecret` | Secret containing extra env vars (in case of sensitive data) | `""` |
|
||||
| `extraVolumes` | Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts` | `[]` |
|
||||
| `extraVolumeMounts` | Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`. | `[]` |
|
||||
| `initContainers` | Add additional init containers to the pod (evaluated as a template) | `[]` |
|
||||
| `sidecars` | Attach additional containers to the pod (evaluated as a template) | `[]` |
|
||||
| `tolerations` | Tolerations for pod assignment | `[]` |
|
||||
| `networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
|
||||
| `networkPolicy.kubeAPIServerPorts` | List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security) | `[]` |
|
||||
| `networkPolicy.allowExternal` | Don't require server label for connections | `true` |
|
||||
| `networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolice | `[]` |
|
||||
| `networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` |
|
||||
| `nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `nodeAffinityPreset.key` | Node label key to match Ignored if `affinity` is set. | `""` |
|
||||
| `nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set. | `[]` |
|
||||
| `affinity` | Affinity for pod assignment | `{}` |
|
||||
| `nodeSelector` | Node labels for pod assignment. Evaluated as a template. | `{}` |
|
||||
| `resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). | `none` |
|
||||
| `resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `podSecurityContext.enabled` | Enable Multus CNI pods' Security Context | `true` |
|
||||
| `podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` |
|
||||
| `podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` |
|
||||
| `podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
|
||||
| `podSecurityContext.fsGroup` | Multus CNI pods' group ID | `0` |
|
||||
| `containerSecurityContext.enabled` | Enable Multus CNI containers' Security Context | `true` |
|
||||
| `containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
|
||||
| `containerSecurityContext.runAsUser` | Multus CNI containers' Security Context | `0` |
|
||||
| `containerSecurityContext.runAsGroup` | Multus CNI containers' Security Context | `0` |
|
||||
| `containerSecurityContext.runAsNonRoot` | Set Multus CNI container's Security Context runAsNonRoot | `false` |
|
||||
| `containerSecurityContext.privileged` | Set Multus CNI container's Security Context privileged | `true` |
|
||||
| `containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `true` |
|
||||
| `containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
|
||||
| `containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` |
|
||||
| `containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
|
||||
| `startupProbe.enabled` | Enable startupProbe | `false` |
|
||||
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` |
|
||||
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
||||
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
|
||||
| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `5` |
|
||||
| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
|
||||
| `livenessProbe.enabled` | Enable livenessProbe | `true` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` |
|
||||
| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
|
||||
| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` |
|
||||
| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `readinessProbe.enabled` | Enable readinessProbe | `true` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||
| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
|
||||
| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` |
|
||||
| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `customStartupProbe` | Override default startup probe | `{}` |
|
||||
| `customLivenessProbe` | Override default liveness probe | `{}` |
|
||||
| `customReadinessProbe` | Override default readiness probe | `{}` |
|
||||
| `lifecycleHooks` | LifecycleHook to set additional configuration at startup Evaluated as a template | `{}` |
|
||||
| `podAnnotations` | Pod annotations | `{}` |
|
||||
| `podLabels` | Add additional labels to the pod (evaluated as a template) | `{}` |
|
||||
|
||||
### Other Parameters
|
||||
|
||||
|
||||
@@ -90,6 +90,9 @@ spec:
|
||||
- name: cni-bin-dir
|
||||
mountPath: {{ .Values.CNIMountPath }}/opt/cni/bin
|
||||
mountPropagation: Bidirectional
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
containers:
|
||||
- name: multus-cni
|
||||
image: {{ template "multus-cni.image" . }}
|
||||
@@ -189,6 +192,9 @@ spec:
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: cni-net-dir
|
||||
mountPath: {{ .Values.CNIMountPath }}/etc/cni/net.d
|
||||
- name: cni-bin-dir
|
||||
@@ -200,6 +206,8 @@ spec:
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
- name: cni-bin-dir
|
||||
hostPath:
|
||||
path: {{ .Values.hostCNIBinDir }}
|
||||
|
||||
@@ -295,16 +295,25 @@ podSecurityContext:
|
||||
## @param containerSecurityContext.enabled Enable Multus CNI containers' Security Context
|
||||
## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
|
||||
## @param containerSecurityContext.runAsUser Multus CNI containers' Security Context
|
||||
## @param containerSecurityContext.runAsGroup Multus CNI containers' Security Context
|
||||
## @param containerSecurityContext.runAsNonRoot Set Multus CNI container's Security Context runAsNonRoot
|
||||
## @param containerSecurityContext.privileged Set Multus CNI container's Security Context privileged
|
||||
## @param containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
|
||||
## @param containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
|
||||
## @param containerSecurityContext.capabilities.drop List of capabilities to be dropped
|
||||
## @param containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
|
||||
##
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
seLinuxOptions: null
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
privileged: true
|
||||
allowPrivilegeEscalation: true
|
||||
readOnlyRootFilesystem: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
## Configure extra options for startup probe
|
||||
|
||||
Reference in New Issue
Block a user