openstack/openstack-helm-infra
Code Issues Proposed changes

[memcached] Allign with security best practices

Browse Source 
* Add runAsNonRoot directive
* Drop all capabilities
* Mount bianries with 550 and 65534 fsgroup

Change-Id: I0636088b40ce8ebaef84dad017ddbcaaecfc8221
This commit is contained in:
Vasyl Saienko 2025-01-01 11:33:22 +00:00
parent 11915a30a7
commit 725dc5518d
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
memcached/templates/statefulset.yaml
View File

@ -132,6 +132,6 @@ spec:
- name: memcached-bin - name: memcached-bin
configMap: configMap:
name: {{ $configMapBinName | quote }} name: {{ $configMapBinName | quote }}
defaultMode: 0555 defaultMode: 360
{{ dict "envAll" $envAll "component" "memcached" "requireSys" true | include "helm-toolkit.snippets.kubernetes_apparmor_volumes" | indent 8 }} {{ dict "envAll" $envAll "component" "memcached" "requireSys" true | include "helm-toolkit.snippets.kubernetes_apparmor_volumes" | indent 8 }}
{{- end }} {{- end }}

8
memcached/values.yaml
View File

@ -150,13 +150,21 @@ pod:
server: server:
pod: pod:
runAsUser: 65534 runAsUser: 65534
runAsNonRoot: true
fsGroup: 65534
container: container:
memcached: memcached:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
memcached_exporter: memcached_exporter:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
probes: probes:
memcached: memcached:
memcached: memcached: