Allow setting securityContext for every container (#46)

* Allow setting securityContext for every container * Update chart version
Enapter · Apr 15, 2022 · 664e6e7 · 664e6e7
1 parent 763df5a
commit 664e6e7
Show file tree

Hide file tree

Showing 4 changed files with 19 additions and 1 deletion.
diff --git a/keydb/Chart.yaml b/keydb/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: keydb
 description: A Helm chart for KeyDB multimaster setup
 type: application
-version: 0.33.4
+version: 0.34.0
 keywords:
 - keydb
 - redis

diff --git a/keydb/README.md b/keydb/README.md
@@ -110,6 +110,8 @@ The following table lists the configurable parameters of the KeyDB chart and the
 | `scripts.enabled`               | Turn on health util scripts                        | `false`                                   |
 | `scripts.cleanupCoredumps`      | Coredumps cleanup scripts                          | Look values.yaml                          |
 | `scripts.cleanupTempfiles`      | Tempfiles cleanup scripts                          | Look values.yaml                          |
+| `scripts.securityContext`       | SecurityContext for scripts container              | `{}`                                      |
+| `keydb.securityContext`         | SecurityContext for KeyDB container                | `{}`                                      |
 | `securityContext`               | SecurityContext for KeyDB pods                     | `{}`                                      |
 | `service.annotations`           | Service annotations                                | `{}`                                      |
 | `loadBalancer.enabled`          | Create LoadBalancer service                        | `false`                                   |
@@ -129,6 +131,7 @@ The following table lists the configurable parameters of the KeyDB chart and the
 | `exporter.readinessProbe`       | ReadinessProbe for sidecar Prometheus exporter     | Look values.yaml                          |
 | `exporter.startupProbe`         | StartupProbe for sidecar Prometheus exporter       | Look values.yaml                          |
 | `exporter.resources`            | Resources for sidecar Prometheus container         | `{}`                                      |
+| `exporter.securityContext`      | SecurityContext for Prometheus exporter container  | `{}`                                      |
 | `exporter.extraArgs`            | Additional arguments for exporter                  | `[]`                                      |
 
 ## Using existingSecret

diff --git a/keydb/templates/sts.yaml b/keydb/templates/sts.yaml
@@ -116,6 +116,8 @@ spec:
         {{- end }}
         resources:
           {{- toYaml .Values.resources | nindent 10 }}
+        securityContext:
+          {{- toYaml .Values.keydb.securityContext | nindent 10 }}
         volumeMounts:
         - name: health
           mountPath: /health
@@ -173,6 +175,8 @@ spec:
         {{- end }}
         resources:
           {{- toYaml .Values.exporter.resources | nindent 10 }}
+        securityContext:
+          {{- toYaml .Values.exporter.securityContext | nindent 10 }}
         ports:
         - name: redis-exporter
           containerPort: {{ .Values.exporter.port }}
@@ -198,6 +202,8 @@ spec:
         {{- end }}
         resources:
           {{- toYaml .Values.scripts.resources | nindent 10 }}
+        securityContext:
+          {{- toYaml .Values.scripts.securityContext | nindent 10 }}
         volumeMounts:
         - name: health
           mountPath: /health

diff --git a/keydb/values.yaml b/keydb/values.yaml
@@ -154,6 +154,10 @@ securityContext: {}
   # - name: vm.overcommit_memory
   #   value: "1"
 
+keydb:
+  # Container security context
+  securityContext: {}
+
 service:
   annotations: {}
 
@@ -212,6 +216,9 @@ exporter:
   # CPU/Memory resource limits/requests
   resources: {}
 
+  # Container security context
+  securityContext: {}
+
   # Additional args for redis exporter
   extraArgs: []
     # - somesimple: "argument"
@@ -223,6 +230,8 @@ scripts:
   enabled: false
   # CPU/Memory resource limits/requests
   resources: {}
+  # Container security context
+  securityContext: {}
   cleanupCoredumps:
     enabled: false
     minutes: 1440