Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-08-10 14:15:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/fluentd] fix: 🔒 Move service-account token auto-mount to pod declaration (#22400)

Browse Source 
Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
2024-01-19 16:32:26 +01:00
committed by GitHub
parent 3af2fcad38
commit d77ca91d96
5 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bitnami/fluentd/Chart.yaml
+1 -1
View File
@@ -30,4 +30,4 @@ maintainers:
name: fluentd
sources:
- https://github.com/bitnami/charts/tree/main/bitnami/fluentd
version: 5.13.1
version: 5.14.0
bitnami/fluentd/README.md
+3 -1
View File
@@ -93,6 +93,7 @@ The command removes all the Kubernetes components associated with the chart and
| `forwarder.image.repository` | Fluentd forwarder image repository override | `""` |
| `forwarder.daemonUser` | Forwarder daemon user and group (set to root by default because it reads from host paths) | `root` |
| `forwarder.daemonGroup` | Fluentd forwarder daemon system group | `root` |
| `forwarder.automountServiceAccountToken` | Mount Service Account token in pod | `true` |
| `forwarder.hostAliases` | Add deployment host aliases | `[]` |
| `forwarder.podSecurityContext.enabled` | Enable security context for forwarder pods | `true` |
| `forwarder.podSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` |
@@ -175,7 +176,7 @@ The command removes all the Kubernetes components associated with the chart and
| `forwarder.serviceAccount.create` | Specify whether a ServiceAccount should be created. | `true` |
| `forwarder.serviceAccount.name` | The name of the ServiceAccount to create | `""` |
| `forwarder.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `forwarder.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` |
| `forwarder.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `false` |
| `forwarder.rbac.create` | Specify whether RBAC resources should be created and used, allowing the get, watch and list of pods/namespaces | `true` |
| `forwarder.rbac.pspEnabled` | Whether to create a PodSecurityPolicy and bound it with RBAC. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `false` |
| `forwarder.persistence.enabled` | Enable persistence volume for the forwarder | `false` |
@@ -202,6 +203,7 @@ The command removes all the Kubernetes components associated with the chart and
| `aggregator.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` |
| `aggregator.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
| `aggregator.podSecurityContext.fsGroup` | Group ID for aggregator's containers filesystem | `1001` |
| `aggregator.automountServiceAccountToken` | Mount Service Account token in pod | `false` |
| `aggregator.hostAliases` | Add deployment host aliases | `[]` |
| `aggregator.containerSecurityContext.enabled` | Enable security context for the aggregator container | `true` |
| `aggregator.containerSecurityContext.privileged` | Run as privileged | `false` |
bitnami/fluentd/templates/aggregator-statefulset.yaml
+1
View File
@@ -40,6 +40,7 @@ spec:
{{- end }}
spec:
{{- include "fluentd.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.aggregator.automountServiceAccountToken }}
{{- if .Values.aggregator.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.aggregator.hostAliases "context" $) | nindent 8 }}
{{- end }}
bitnami/fluentd/templates/forwarder-daemonset.yaml
+1
View File
@@ -35,6 +35,7 @@ spec:
{{- end }}
spec:
{{- include "fluentd.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.forwarder.automountServiceAccountToken }}
{{- if .Values.forwarder.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.forwarder.hostAliases "context" $) | nindent 8 }}
{{- end }}
bitnami/fluentd/values.yaml
+7 -1
View File
@@ -107,6 +107,9 @@ forwarder:
## @param forwarder.daemonGroup Fluentd forwarder daemon system group
##
daemonGroup: root
## @param forwarder.automountServiceAccountToken Mount Service Account token in pod
##
automountServiceAccountToken: true
## @param forwarder.hostAliases Add deployment host aliases
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
##
@@ -556,7 +559,7 @@ forwarder:
annotations: {}
## @param forwarder.serviceAccount.automountServiceAccountToken Automount service account token for the server service account
##
automountServiceAccountToken: true
automountServiceAccountToken: false
## Role Based Access
## ref: https://kubernetes.io/docs/admin/authorization/rbac/
@@ -685,6 +688,9 @@ aggregator:
sysctls: []
supplementalGroups: []
fsGroup: 1001
## @param aggregator.automountServiceAccountToken Mount Service Account token in pod
##
automountServiceAccountToken: false
## @param aggregator.hostAliases Add deployment host aliases
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
##