From a63c4c6d3780c480c11a0bb39b5c6218e52c9210 Mon Sep 17 00:00:00 2001 From: jklein Date: Mon, 13 Apr 2026 15:12:18 +0200 Subject: [PATCH] feat(template): moved security-context, port and env configuration to values.yaml --- template-chart/templates/xxx.configmap.yaml | 6 +++ template-chart/templates/xxx.deployment.yaml | 48 +++++++++++-------- template-chart/templates/xxx.sfs.yaml | 50 +++++++++++--------- template-chart/values.yaml | 32 +++++++++++++ 4 files changed, 94 insertions(+), 42 deletions(-) create mode 100644 template-chart/templates/xxx.configmap.yaml diff --git a/template-chart/templates/xxx.configmap.yaml b/template-chart/templates/xxx.configmap.yaml new file mode 100644 index 0000000..7398cbf --- /dev/null +++ b/template-chart/templates/xxx.configmap.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: "{{ .Release.Name }}-{{ .Chart.Name}}-config-map" +data: + key: "value" diff --git a/template-chart/templates/xxx.deployment.yaml b/template-chart/templates/xxx.deployment.yaml index 54d0a45..9ab7c10 100644 --- a/template-chart/templates/xxx.deployment.yaml +++ b/template-chart/templates/xxx.deployment.yaml @@ -17,34 +17,42 @@ spec: spec: automountServiceAccountToken: false securityContext: - runAsNonRoot: true - runAsUser: 20000 - runAsGroup: 1000 - fsGroup: 1000 - fsGroupChangePolicy: Always + {{- toYaml .Values.xxx.securityContext.pod | nindent 8 }} containers: - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment image: "registry/image:{{ .Chart.AppVersion }}" imagePullPolicy: IfNotPresent + env: + {{- range $value := .Values.xxx.env }} + {{- if $value.value }} + - name: {{ $value.name }} + value: {{ $value.value }} + {{- else if $value.valueFrom }} + {{- if $value.valueFrom.secretKeyRef }} + - name: {{ $value.name }} + valueFrom: + secretKeyRef: + name: {{ tpl $value.valueFrom.secretKeyRef.name $ }} + key: {{ tpl $value.valueFrom.secretKeyRef.key $ }} + {{- else if $value.valueFrom.configMapKeyRef }} + - name: {{ $value.name }} + valueFrom: + configMapKeyRef: + name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }} + key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }} + {{- end }} + {{- end }} + {{- end }} ports: - - containerPort: 80 - protocol: TCP - name: http + {{- toYaml .Values.xxx.ports | nindent 12 }} livenessProbe: - {{ toYaml .Values.xxx.livenessProbe | nindent 12 }} + {{- toYaml .Values.xxx.livenessProbe | nindent 12 }} readinessProbe: - {{ toYaml .Values.xxx.readinessProbe | nindent 12 }} + {{- toYaml .Values.xxx.readinessProbe | nindent 12 }} startupProbe: - {{ toYaml .Values.xxx.startupProbe | nindent 12 }} + {{- toYaml .Values.xxx.startupProbe | nindent 12 }} resources: - {{ toYaml .Values.xxx.resources | nindent 12 }} + {{- toYaml .Values.xxx.resources | nindent 12 }} securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - add: - - + {{- toYaml .Values.xxx.securityContext.container | nindent 12 }} restartPolicy: Always diff --git a/template-chart/templates/xxx.sfs.yaml b/template-chart/templates/xxx.sfs.yaml index 6a038f3..b6fd9de 100644 --- a/template-chart/templates/xxx.sfs.yaml +++ b/template-chart/templates/xxx.sfs.yaml @@ -18,36 +18,42 @@ spec: spec: automountServiceAccountToken: false securityContext: - runAsNonRoot: true - runAsUser: 20000 - runAsGroup: 1000 - fsGroup: 1000 - fsGroupChangePolicy: Always + {{- toYaml .Values.xxx.securityContext.pod | nindent 8 }} containers: - name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs image: "registry/image:{{ .Chart.AppVersion }}" imagePullPolicy: IfNotPresent + env: + {{- range $value := .Values.xxx.env }} + {{- if $value.value }} + - name: {{ $value.name }} + value: {{ $value.value }} + {{- else if $value.valueFrom }} + {{- if $value.valueFrom.secretKeyRef }} + - name: {{ $value.name }} + valueFrom: + secretKeyRef: + name: {{ tpl $value.valueFrom.secretKeyRef.name $ }} + key: {{ tpl $value.valueFrom.secretKeyRef.key $ }} + {{- else if $value.valueFrom.configMapKeyRef }} + - name: {{ $value.name }} + valueFrom: + configMapKeyRef: + name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }} + key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }} + {{- end }} + {{- end }} + {{- end }} ports: - - containerPort: 80 - protocol: TCP - name: http + {{- toYaml .Values.xxx.ports | nindent 12 }} livenessProbe: - {{ toYaml .Values.xxx.livenessProbe | nindent 12 }} + {{- toYaml .Values.xxx.livenessProbe | nindent 12 }} readinessProbe: - {{ toYaml .Values.xxx.readinessProbe | nindent 12 }} + {{- toYaml .Values.xxx.readinessProbe | nindent 12 }} startupProbe: - {{ toYaml .Values.xxx.startupProbe | nindent 12 }} - {{- with .Values.xxx.resources }} + {{- toYaml .Values.xxx.startupProbe | nindent 12 }} resources: - {{ toYaml . | nindent 12 }} - {{- end }} + {{- toYaml .Values.xxx.resources | nindent 12 }} securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - add: - - + {{- toYaml .Values.xxx.securityContext.container | nindent 12 }} restartPolicy: Always diff --git a/template-chart/values.yaml b/template-chart/values.yaml index e10ac55..dd2349d 100644 --- a/template-chart/values.yaml +++ b/template-chart/values.yaml @@ -35,6 +35,38 @@ xxx: periodSeconds: 10 timeoutSeconds: 5 failureThreshold: 3 + securityContext: + pod: + runAsNonRoot: true + runAsUser: 20000 + runAsGroup: 1000 + fsGroup: 1000 + fsGroupChangePolicy: Always + container: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + add: [] + ports: + - containerPort: 80 + protocol: TCP + name: http + env: + - name: NORMAL_ENV + value: "123" + - name: ENV_FROM_SECRET + valueFrom: + secretKeyRef: + name: "{{ .Release.Name }}-{{ .Chart.Name }}-secret" + key: "secretKey" + - name: ENV_FROM_CONFIGMAP + valueFrom: + configMapKeyRef: + name: "{{ .Release.Name }}-{{ .Chart.Name }}-config-map" + key: "configMapKey" storage: amount: 10Gi