feat(template): moved security-context, port and env configuration to values.yaml

template-chart/templates/xxx.configmap.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ .Release.Name }}-{{ .Chart.Name}}-config-map"
+data:
+  key: "value"

template-chart/templates/xxx.deployment.yaml

@@ -17,34 +17,42 @@ spec:
     spec:
       automountServiceAccountToken: false
       securityContext:
-        runAsNonRoot: true
+        {{- toYaml .Values.xxx.securityContext.pod | nindent 8 }}
-        runAsUser: 20000
-        runAsGroup: 1000
-        fsGroup: 1000
-        fsGroupChangePolicy: Always
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
           image: "registry/image:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
+          env:
+            {{- range $value := .Values.xxx.env }}
+            {{- if $value.value }}
+            - name: {{ $value.name }}
+              value: {{ $value.value }}
+            {{- else if $value.valueFrom }}
+            {{- if $value.valueFrom.secretKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ }}
+                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ }}
+            {{- else if $value.valueFrom.configMapKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }}
+                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
           ports:
-            - containerPort: 80
+            {{- toYaml .Values.xxx.ports | nindent 12 }}
-              protocol: TCP
-              name: http
           livenessProbe:
-            {{ toYaml .Values.xxx.livenessProbe | nindent 12 }}
+            {{- toYaml .Values.xxx.livenessProbe | nindent 12 }}
           readinessProbe:
-            {{ toYaml .Values.xxx.readinessProbe | nindent 12 }}
+            {{- toYaml .Values.xxx.readinessProbe | nindent 12 }}
           startupProbe:
-            {{ toYaml .Values.xxx.startupProbe | nindent 12 }}
+            {{- toYaml .Values.xxx.startupProbe | nindent 12 }}
           resources:
-            {{ toYaml .Values.xxx.resources | nindent 12 }}
+            {{- toYaml .Values.xxx.resources | nindent 12 }}
           securityContext:
-            allowPrivilegeEscalation: false
+            {{- toYaml .Values.xxx.securityContext.container | nindent 12 }}
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-                - ALL
-              add:
-                -
       restartPolicy: Always

template-chart/templates/xxx.sfs.yaml

@@ -18,36 +18,42 @@ spec:
     spec:
       automountServiceAccountToken: false
       securityContext:
-        runAsNonRoot: true
+        {{- toYaml .Values.xxx.securityContext.pod | nindent 8 }}
-        runAsUser: 20000
-        runAsGroup: 1000
-        fsGroup: 1000
-        fsGroupChangePolicy: Always
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
           image: "registry/image:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
+          env:
+            {{- range $value := .Values.xxx.env }}
+            {{- if $value.value }}
+            - name: {{ $value.name }}
+              value: {{ $value.value }}
+            {{- else if $value.valueFrom }}
+            {{- if $value.valueFrom.secretKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ }}
+                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ }}
+            {{- else if $value.valueFrom.configMapKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }}
+                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
           ports:
-            - containerPort: 80
+            {{- toYaml .Values.xxx.ports | nindent 12 }}
-              protocol: TCP
-              name: http
           livenessProbe:
-            {{ toYaml .Values.xxx.livenessProbe | nindent 12 }}
+            {{- toYaml .Values.xxx.livenessProbe | nindent 12 }}
           readinessProbe:
-            {{ toYaml .Values.xxx.readinessProbe | nindent 12 }}
+            {{- toYaml .Values.xxx.readinessProbe | nindent 12 }}
           startupProbe:
-            {{ toYaml .Values.xxx.startupProbe | nindent 12 }}
+            {{- toYaml .Values.xxx.startupProbe | nindent 12 }}
-          {{- with .Values.xxx.resources }}
           resources:
-            {{ toYaml . | nindent 12 }}
+            {{- toYaml .Values.xxx.resources | nindent 12 }}
-          {{- end }}
           securityContext:
-            allowPrivilegeEscalation: false
+            {{- toYaml .Values.xxx.securityContext.container | nindent 12 }}
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-                - ALL
-              add:
-                -
       restartPolicy: Always

template-chart/values.yaml

@@ -35,6 +35,38 @@ xxx:
     periodSeconds: 10
     timeoutSeconds: 5
     failureThreshold: 3
+  securityContext:
+    pod:
+      runAsNonRoot: true
+      runAsUser: 20000
+      runAsGroup: 1000
+      fsGroup: 1000
+      fsGroupChangePolicy: Always
+    container:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      capabilities:
+        drop:
+          - ALL
+        add: []
+  ports:
+    - containerPort: 80
+      protocol: TCP
+      name: http
+  env:
+    - name: NORMAL_ENV
+      value: "123"
+    - name: ENV_FROM_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: "{{ .Release.Name }}-{{ .Chart.Name }}-secret"
+          key: "secretKey"
+    - name: ENV_FROM_CONFIGMAP
+      valueFrom:
+        configMapKeyRef:
+          name: "{{ .Release.Name }}-{{ .Chart.Name }}-config-map"
+          key: "configMapKey"
 
 storage:
   amount: 10Gi