Merge pull request #1066 from JaneLiuL/securitycontext

expose security context from helm chart
kubernetes-sigs · Mar 10, 2023 · 85e9f86 · 85e9f86
2 parents 7106115 + 12965c4
commit 85e9f86
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 14 deletions.
diff --git a/charts/descheduler/templates/cronjob.yaml b/charts/descheduler/templates/cronjob.yaml
@@ -81,13 +81,7 @@ spec:
               resources:
                 {{- toYaml .Values.resources | nindent 16 }}
               securityContext:
-                allowPrivilegeEscalation: false
-                capabilities:
-                  drop:
-                    - ALL
-                privileged: false
-                readOnlyRootFilesystem: true
-                runAsNonRoot: true
+                {{- toYaml .Values.securityContext | nindent 16 }}
               volumeMounts:
                 - mountPath: /policy-dir
                   name: policy-volume

diff --git a/charts/descheduler/templates/deployment.yaml b/charts/descheduler/templates/deployment.yaml
@@ -65,13 +65,7 @@ spec:
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
           securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            privileged: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
+            {{- toYaml .Values.securityContext | nindent 12 }}
           volumeMounts:
             - mountPath: /policy-dir
               name: policy-volume

diff --git a/charts/descheduler/values.yaml b/charts/descheduler/values.yaml
@@ -22,6 +22,16 @@ resources:
   #   cpu: 100m
   #   memory: 128Mi
 
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  privileged: false
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
+
 nameOverride: ""
 fullnameOverride: ""