Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-08-10 14:15:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/elasticsearch] fix: 🔒 Move service-account token auto-mount to pod declaration (#22396)

Browse Source 
Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
Signed-off-by: Miguel Ruiz <miruiz@vmware.com>
Co-authored-by: Miguel Ruiz <miruiz@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
2024-01-19 11:57:05 +01:00
committed by GitHub
co-authored by Miguel Ruiz
parent f6306884b8
commit 6d4060fa0e
8 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bitnami/elasticsearch/Chart.yaml
+1 -1
View File
@@ -34,4 +34,4 @@ maintainers:
name: elasticsearch
sources:
- https://github.com/bitnami/charts/tree/main/bitnami/elasticsearch
version: 19.16.3
version: 19.17.0
bitnami/elasticsearch/README.md
+5
View File
@@ -196,6 +196,7 @@ helm delete --purge my-release
| `master.containerSecurityContext.runAsUser` | Set master-elegible containers' Security Context runAsUser | `1001` |
| `master.containerSecurityContext.runAsNonRoot` | Set master-elegible containers' Security Context runAsNonRoot | `true` |
| `master.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
| `master.automountServiceAccountToken` | Mount Service Account token in pod | `false` |
| `master.hostAliases` | master-elegible pods host aliases | `[]` |
| `master.podLabels` | Extra labels for master-elegible pods | `{}` |
| `master.podAnnotations` | Annotations for master-elegible pods | `{}` |
@@ -288,6 +289,7 @@ helm delete --purge my-release
| `data.containerSecurityContext.runAsUser` | Set data containers' Security Context runAsUser | `1001` |
| `data.containerSecurityContext.runAsNonRoot` | Set data containers' Security Context runAsNonRoot | `true` |
| `data.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
| `data.automountServiceAccountToken` | Mount Service Account token in pod | `false` |
| `data.hostAliases` | data pods host aliases | `[]` |
| `data.podLabels` | Extra labels for data pods | `{}` |
| `data.podAnnotations` | Annotations for data pods | `{}` |
@@ -380,6 +382,7 @@ helm delete --purge my-release
| `coordinating.containerSecurityContext.runAsUser` | Set coordinating-only containers' Security Context runAsUser | `1001` |
| `coordinating.containerSecurityContext.runAsNonRoot` | Set coordinating-only containers' Security Context runAsNonRoot | `true` |
| `coordinating.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
| `coordinating.automountServiceAccountToken` | Mount Service Account token in pod | `false` |
| `coordinating.hostAliases` | coordinating-only pods host aliases | `[]` |
| `coordinating.podLabels` | Extra labels for coordinating-only pods | `{}` |
| `coordinating.podAnnotations` | Annotations for coordinating-only pods | `{}` |
@@ -467,6 +470,7 @@ helm delete --purge my-release
| `ingest.containerSecurityContext.runAsUser` | Set ingest-only containers' Security Context runAsUser | `1001` |
| `ingest.containerSecurityContext.runAsNonRoot` | Set ingest-only containers' Security Context runAsNonRoot | `true` |
| `ingest.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
| `ingest.automountServiceAccountToken` | Mount Service Account token in pod | `false` |
| `ingest.hostAliases` | ingest-only pods host aliases | `[]` |
| `ingest.podLabels` | Extra labels for ingest-only pods | `{}` |
| `ingest.podAnnotations` | Annotations for ingest-only pods | `{}` |
@@ -566,6 +570,7 @@ helm delete --purge my-release
| `metrics.image.pullSecrets` | Metrics exporter image pull secrets | `[]` |
| `metrics.annotations` | Annotations for metrics | `{}` |
| `metrics.extraArgs` | Extra arguments to add to the default exporter command | `[]` |
| `metrics.automountServiceAccountToken` | Mount Service Account token in pod | `false` |
| `metrics.hostAliases` | Add deployment host aliases | `[]` |
| `metrics.schedulerName` | Name of the k8s scheduler (other than default) | `""` |
| `metrics.priorityClassName` | Elasticsearch metrics exporter pods' priorityClassName | `""` |
bitnami/elasticsearch/templates/coordinating/statefulset.yaml
+1
View File
@@ -50,6 +50,7 @@ spec:
spec:
serviceAccountName: {{ template "elasticsearch.coordinating.serviceAccountName" . }}
{{- include "elasticsearch.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.coordinating.automountServiceAccountToken }}
{{- if .Values.coordinating.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.coordinating.hostAliases "context" $) | nindent 8 }}
{{- end }}
bitnami/elasticsearch/templates/data/statefulset.yaml
+1
View File
@@ -50,6 +50,7 @@ spec:
spec:
serviceAccountName: {{ template "elasticsearch.data.serviceAccountName" . }}
{{- include "elasticsearch.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.data.automountServiceAccountToken }}
{{- if .Values.data.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.data.hostAliases "context" $) | nindent 8 }}
{{- end }}
bitnami/elasticsearch/templates/ingest/statefulset.yaml
+1
View File
@@ -50,6 +50,7 @@ spec:
spec:
serviceAccountName: {{ template "elasticsearch.ingest.serviceAccountName" . }}
{{- include "elasticsearch.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.ingest.automountServiceAccountToken }}
{{- if .Values.ingest.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.ingest.hostAliases "context" $) | nindent 8 }}
{{- end }}
bitnami/elasticsearch/templates/master/statefulset.yaml
+1
View File
@@ -50,6 +50,7 @@ spec:
spec:
serviceAccountName: {{ template "elasticsearch.master.serviceAccountName" . }}
{{- include "elasticsearch.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.master.automountServiceAccountToken }}
{{- if .Values.master.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.master.hostAliases "context" $) | nindent 8 }}
{{- end }}
bitnami/elasticsearch/templates/metrics/deployment.yaml
+1
View File
@@ -39,6 +39,7 @@ spec:
spec:
{{- include "elasticsearch.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "elasticsearch.metrics.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.metrics.automountServiceAccountToken }}
{{- if .Values.metrics.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.hostAliases "context" $) | nindent 8 }}
{{- end }}
bitnami/elasticsearch/values.yaml
+15
View File
@@ -555,6 +555,9 @@ master:
runAsNonRoot: true
seccompProfile:
type: "RuntimeDefault"
## @param master.automountServiceAccountToken Mount Service Account token in pod
##
automountServiceAccountToken: false
## @param master.hostAliases master-elegible pods host aliases
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
##
@@ -877,6 +880,9 @@ data:
runAsNonRoot: true
seccompProfile:
type: "RuntimeDefault"
## @param data.automountServiceAccountToken Mount Service Account token in pod
##
automountServiceAccountToken: false
## @param data.hostAliases data pods host aliases
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
##
@@ -1200,6 +1206,9 @@ coordinating:
runAsNonRoot: true
seccompProfile:
type: "RuntimeDefault"
## @param coordinating.automountServiceAccountToken Mount Service Account token in pod
##
automountServiceAccountToken: false
## @param coordinating.hostAliases coordinating-only pods host aliases
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
##
@@ -1492,6 +1501,9 @@ ingest:
runAsNonRoot: true
seccompProfile:
type: "RuntimeDefault"
## @param ingest.automountServiceAccountToken Mount Service Account token in pod
##
automountServiceAccountToken: false
## @param ingest.hostAliases ingest-only pods host aliases
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
##
@@ -1908,6 +1920,9 @@ metrics:
## - --es.indices
##
extraArgs: []
## @param metrics.automountServiceAccountToken Mount Service Account token in pod
##
automountServiceAccountToken: false
## @param metrics.hostAliases Add deployment host aliases
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
##