diff --git a/apis/installer/v1alpha1/kubedb_provisioner_types.go b/apis/installer/v1alpha1/kubedb_provisioner_types.go index 68f83a245..ff7794d03 100644 --- a/apis/installer/v1alpha1/kubedb_provisioner_types.go +++ b/apis/installer/v1alpha1/kubedb_provisioner_types.go @@ -84,6 +84,8 @@ type KubedbProvisionerSpec struct { // +optional LicenseSecretName string `json:"licenseSecretName"` Psp PSPSpec `json:"psp"` + // +optional + DefaultSeccompProfileType string `json:"defaultSeccompProfileType"` } // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object diff --git a/charts/kubedb-provisioner/README.md b/charts/kubedb-provisioner/README.md index 61d0cf511..aba4f1145 100644 --- a/charts/kubedb-provisioner/README.md +++ b/charts/kubedb-provisioner/README.md @@ -81,6 +81,7 @@ The following table lists the configurable parameters of the `kubedb-provisioner | monitoring.serviceMonitor.labels | Specify the labels for ServiceMonitor. Prometheus crd will select ServiceMonitor using these labels. Only usable when monitoring agent is `prometheus.io/operator`. | {"monitoring.appscode.com/prometheus":"auto"} | | additionalPodSecurityPolicies | Additional psp names passed to operator
Example:
`helm template ./chart/kubedb \`
`--set additionalPodSecurityPolicies[0]=abc \`
`--set additionalPodSecurityPolicies[1]=xyz` | [] | | psp.enabled | | true | +| defaultSeccompProfileType | | "" | Specify each parameter using the `--set key=value[,key=value]` argument to `helm upgrade -i`. For example: diff --git a/charts/kubedb-provisioner/templates/deployment.yaml b/charts/kubedb-provisioner/templates/deployment.yaml index 336f4ce83..5aac1d28e 100644 --- a/charts/kubedb-provisioner/templates/deployment.yaml +++ b/charts/kubedb-provisioner/templates/deployment.yaml @@ -43,6 +43,7 @@ spec: - --v={{ .Values.logLevel }} - --use-kubeapiserver-fqdn-for-aks={{ .Values.apiserver.useKubeapiserverFqdnForAks }} - --metrics-bind-address=:{{ .Values.monitoring.bindPort }} + - --default-seccomp-profile-type={{ .Values.defaultSeccompProfileType }} - --health-probe-bind-address=:{{ .Values.apiserver.healthcheck.probePort }} {{- include "docker.imagePullSecretFlags" . | nindent 8 }} {{- include "docker.insecureRegistries" . | nindent 8 }} diff --git a/charts/kubedb-provisioner/values.openapiv3_schema.yaml b/charts/kubedb-provisioner/values.openapiv3_schema.yaml index 5ada9ab78..fa6fcaab2 100644 --- a/charts/kubedb-provisioner/values.openapiv3_schema.yaml +++ b/charts/kubedb-provisioner/values.openapiv3_schema.yaml @@ -777,6 +777,8 @@ properties: type: object criticalAddon: type: boolean + defaultSeccompProfileType: + type: string enforceTerminationPolicy: type: boolean fullnameOverride: diff --git a/charts/kubedb-provisioner/values.yaml b/charts/kubedb-provisioner/values.yaml index 35ab02e79..9d51398ab 100644 --- a/charts/kubedb-provisioner/values.yaml +++ b/charts/kubedb-provisioner/values.yaml @@ -118,3 +118,5 @@ monitoring: additionalPodSecurityPolicies: [] psp: enabled: true + +defaultSeccompProfileType: "" diff --git a/charts/kubedb/values.openapiv3_schema.yaml b/charts/kubedb/values.openapiv3_schema.yaml index 171cade9e..5e3a2eec8 100644 --- a/charts/kubedb/values.openapiv3_schema.yaml +++ b/charts/kubedb/values.openapiv3_schema.yaml @@ -5056,6 +5056,8 @@ properties: type: object criticalAddon: type: boolean + defaultSeccompProfileType: + type: string enabled: type: boolean enforceTerminationPolicy: