mirror of
https://github.com/bitnami/charts.git
synced 2026-08-10 14:15:55 +08:00
[bitnami/concourse] fix: 🔒 Move service-account token auto-mount to pod declaration (#22391)
Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com> Signed-off-by: Javier J. Salmerón-García <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
@@ -37,4 +37,4 @@ maintainers:
|
||||
name: concourse
|
||||
sources:
|
||||
- https://github.com/bitnami/charts/tree/main/bitnami/concourse
|
||||
version: 3.2.1
|
||||
version: 3.3.0
|
||||
|
||||
@@ -178,6 +178,7 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `web.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` |
|
||||
| `web.containerSecurityContext.runAsUser` | Set web containers' Security Context runAsUser | `1001` |
|
||||
| `web.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
|
||||
| `web.automountServiceAccountToken` | Mount Service Account token in pod | `true` |
|
||||
| `web.hostAliases` | Concourse web pod host aliases | `[]` |
|
||||
| `web.podLabels` | Extra labels for Concourse web pods | `{}` |
|
||||
| `web.podAnnotations` | Annotations for Concourse web pods | `{}` |
|
||||
@@ -205,7 +206,7 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `web.rbac.rules` | Custom RBAC rules to set | `[]` |
|
||||
| `web.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
|
||||
| `web.serviceAccount.name` | Override Web service account name | `""` |
|
||||
| `web.serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `true` |
|
||||
| `web.serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `false` |
|
||||
| `web.serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` |
|
||||
|
||||
### Concourse Worker parameters
|
||||
@@ -268,6 +269,7 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `worker.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` |
|
||||
| `worker.containerSecurityContext.runAsUser` | Set worker containers' Security Context user | `0` |
|
||||
| `worker.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
|
||||
| `worker.automountServiceAccountToken` | Mount Service Account token in pod | `true` |
|
||||
| `worker.hostAliases` | Concourse worker pod host aliases | `[]` |
|
||||
| `worker.podLabels` | Custom labels for Concourse worker pods | `{}` |
|
||||
| `worker.podAnnotations` | Annotations for Concourse worker pods | `{}` |
|
||||
@@ -314,7 +316,7 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `worker.rbac.rules` | Custom RBAC rules to set | `[]` |
|
||||
| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
|
||||
| `worker.serviceAccount.name` | Override worker service account name | `""` |
|
||||
| `worker.serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `true` |
|
||||
| `worker.serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `false` |
|
||||
| `worker.serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` |
|
||||
|
||||
### Traffic exposure parameters
|
||||
|
||||
@@ -32,6 +32,7 @@ spec:
|
||||
app.kubernetes.io/component: web
|
||||
spec:
|
||||
{{- include "concourse.imagePullSecrets" . | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.web.automountServiceAccountToken }}
|
||||
{{- if .Values.web.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.web.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -34,6 +34,7 @@ spec:
|
||||
spec:
|
||||
serviceAccountName: {{ template "concourse.worker.serviceAccountName" . }}
|
||||
{{- include "concourse.imagePullSecrets" . | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.worker.automountServiceAccountToken }}
|
||||
{{- if .Values.worker.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.worker.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -36,6 +36,7 @@ spec:
|
||||
spec:
|
||||
serviceAccountName: {{ template "concourse.worker.serviceAccountName" . }}
|
||||
{{- include "concourse.imagePullSecrets" . | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.worker.automountServiceAccountToken }}
|
||||
{{- if .Values.worker.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.worker.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -472,6 +472,9 @@ web:
|
||||
runAsUser: 1001
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
## @param web.automountServiceAccountToken Mount Service Account token in pod
|
||||
##
|
||||
automountServiceAccountToken: true
|
||||
## @param web.hostAliases Concourse web pod host aliases
|
||||
##
|
||||
hostAliases: []
|
||||
@@ -608,7 +611,7 @@ web:
|
||||
## @param web.serviceAccount.automountServiceAccountToken Allows auto mount of ServiceAccountToken on the serviceAccount created
|
||||
## Can be set to false if pods using this serviceAccount do not need to use K8s API
|
||||
##
|
||||
automountServiceAccountToken: true
|
||||
automountServiceAccountToken: false
|
||||
## @param web.serviceAccount.annotations Additional custom annotations for the ServiceAccount
|
||||
##
|
||||
annotations: {}
|
||||
@@ -770,6 +773,9 @@ worker:
|
||||
runAsUser: 0
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
## @param worker.automountServiceAccountToken Mount Service Account token in pod
|
||||
##
|
||||
automountServiceAccountToken: true
|
||||
## @param worker.hostAliases Concourse worker pod host aliases
|
||||
##
|
||||
hostAliases: []
|
||||
@@ -991,7 +997,7 @@ worker:
|
||||
## @param worker.serviceAccount.automountServiceAccountToken Allows auto mount of ServiceAccountToken on the serviceAccount created
|
||||
## Can be set to false if pods using this serviceAccount do not need to use K8s API
|
||||
##
|
||||
automountServiceAccountToken: true
|
||||
automountServiceAccountToken: false
|
||||
## @param worker.serviceAccount.annotations Additional custom annotations for the ServiceAccount
|
||||
##
|
||||
annotations: {}
|
||||
|
||||
Reference in New Issue
Block a user