Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-03-16 06:47:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/fluent-bit] feat: ✨ 🔒 Add readOnlyRootFilesystem support (#23891)

Browse Source 
Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
2024-02-27 11:59:09 +01:00
committed by GitHub
parent 629f25a585
commit 09c0f95888
5 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bitnami/fluent-bit/Chart.yaml
View File

@@ -28,4 +28,4 @@ maintainers:
name: fluent-bit
sources:
- https://github.com/bitnami/charts/tree/main/bitnami/fluent-bit
version: 0.10.2
version: 0.11.0

1
bitnami/fluent-bit/README.md
View File

@@ -170,6 +170,7 @@ The command removes all the Kubernetes components associated with the chart and
| `containerSecurityContext.enabled` | Enabled Fluent Bit containers' Security Context | `true` |
| `containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `containerSecurityContext.runAsUser` | Set Fluent Bit containers' Security Context runAsUser | `1001` |
| `containerSecurityContext.runAsGroup` | Set Fluent Bit containers' Security Context runAsGroup | `0` |
| `containerSecurityContext.runAsNonRoot` | Set Fluent Bit container's Security Context runAsNonRoot | `true` |
| `containerSecurityContext.readOnlyRootFilesystem` | Set Fluent Bit container's Security Context runAsNonRoot | `false` |
| `containerSecurityContext.privileged` | Set primary container's Security Context privileged | `false` |

5
bitnami/fluent-bit/templates/daemonset.yaml
View File

@@ -149,6 +149,9 @@ spec:
- name: etcmachineid
mountPath: /etc/machine-id
readOnly: true
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.extraVolumeMounts }}
{{- include "common.tplvalues.render" ( dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
@@ -156,6 +159,8 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
- name: config
configMap:
name: {{ include "fluent-bit.configuration.configMap" . }}

5
bitnami/fluent-bit/templates/deployment.yaml
View File

@@ -140,6 +140,9 @@ spec:
- name: config
mountPath: /opt/bitnami/fluent-bit/conf/custom_parsers.conf
subPath: custom_parsers.conf
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.extraVolumeMounts }}
{{- include "common.tplvalues.render" ( dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
@@ -147,6 +150,8 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
- name: config
configMap:
name: {{ include "fluent-bit.configuration.configMap" . }}

2
bitnami/fluent-bit/values.yaml
View File

@@ -397,6 +397,7 @@ podSecurityContext:
## @param containerSecurityContext.enabled Enabled Fluent Bit containers' Security Context
## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param containerSecurityContext.runAsUser Set Fluent Bit containers' Security Context runAsUser
## @param containerSecurityContext.runAsGroup Set Fluent Bit containers' Security Context runAsGroup
## @param containerSecurityContext.runAsNonRoot Set Fluent Bit container's Security Context runAsNonRoot
## @param containerSecurityContext.readOnlyRootFilesystem Set Fluent Bit container's Security Context runAsNonRoot
## @param containerSecurityContext.privileged Set primary container's Security Context privileged
@@ -408,6 +409,7 @@ containerSecurityContext:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
allowPrivilegeEscalation: false