Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for read-only root filesystem and enable by default #235

Merged
merged 10 commits into from
Nov 30, 2023
Merged

Add support for read-only root filesystem and enable by default #235

Changes from 8 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
a5fcfa6
Change /tmp/ansible-operator/runner volume mount path to just /tmp so…
eli-gc Nov 27, 2023
755bc05
mount emptyDir to ansible tmp directory
eli-gc Nov 29, 2023
abc433e
remove opt mount and create env variable for ANSIBlE_LOCAL_TEMP
eli-gc Nov 29, 2023
f65930b
Update localAnsibleTmpPath default value to /tmp/ansible/tmp for bett…
eli-gc Nov 29, 2023
c864a3f
Merge pull request #1 from eli-gc/tmp-testing
eli-gc Nov 29, 2023
f6084c3
read-only filesystem enabled by default
eli-gc Nov 29, 2023
ad9b4d5
hardcode ANSIBLE_LOCAL_TEMP to prevent changes
eli-gc Nov 29, 2023
1834c36
move ANSIBLE_LOCAL_TEMP down with other ansible env vars
eli-gc Nov 29, 2023
439fec5
add ANSIBLE_REMOTE_TEMP env var
eli-gc Nov 30, 2023
f805229
Merge pull request #2 from eli-gc/add-ansible-remote-temp
eli-gc Nov 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions kiali-operator/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,13 +61,14 @@ spec:
allowPrivilegeEscalation: false
privileged: false
runAsNonRoot: true
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
{{- end }}
volumeMounts:
- mountPath: /tmp/ansible-operator/runner
name: runner
- mountPath: /tmp
name: tmp
env:
- name: WATCH_NAMESPACE
value: {{ .Values.watchNamespace | default "\"\"" }}
Expand Down Expand Up @@ -109,6 +110,8 @@ spec:
{{- else }}
value: "/etc/ansible/ansible.cfg"
{{- end }}
- name: ANSIBLE_LOCAL_TEMP
value: "/tmp/ansible/tmp"
eli-gc marked this conversation as resolved.
Show resolved Hide resolved
{{- if .Values.env }}
{{- toYaml .Values.env | nindent 8 }}
{{- end }}
Expand All @@ -120,7 +123,7 @@ spec:
{{- toYaml .Values.resources | nindent 10 }}
{{- end }}
volumes:
- name: runner
- name: tmp
emptyDir: {}
affinity:
{{- toYaml .Values.affinity | nindent 8 }}
Expand Down
Loading