Added Security Context at Container Level

reportportal/templates/service-api/api-deployment.yaml

@@ -39,6 +39,8 @@ spec:
         - name: migrations-waiting-init
           image: "{{ include "reportportal.image" (dict "Values" .Values "service" "k8sWaitFor") }}"
           imagePullPolicy: IfNotPresent
+          securityContext:
+{{ toYaml .Values.serviceapi.containerSecurityContext | indent 12}}
           args:
             - "job-wr"
             - {{ include "reportportal.fullname" . }}-migrations
@@ -56,6 +58,8 @@ spec:
         - name: "{{ $.Values.serviceapi.name | default "api" }}"
           image: "{{ include "reportportal.image" (dict "Values" .Values "service" "serviceapi") }}"
           imagePullPolicy: "{{ .Values.serviceapi.pullPolicy }}"
+          securityContext:
+{{ toYaml .Values.serviceapi.containerSecurityContext | indent 12 }}
           ports:
             - containerPort: 8585
               protocol: TCP

reportportal/templates/service-authorization/uat-deployment.yaml

@@ -40,6 +40,8 @@ spec:
         - name: migrations-waiting-init
           image: "{{ include "reportportal.image" (dict "Values" .Values "service" "k8sWaitFor") }}"
           imagePullPolicy: IfNotPresent
+          securityContext:
+{{ toYaml .Values.uat.containerSecurityContext | indent 12}}
           args:
             - "job-wr"
             - {{ include "reportportal.fullname" . }}-migrations
@@ -57,6 +59,8 @@ spec:
         - name: "{{ $.Values.uat.name | default "uat" }}"
           image: "{{ include "reportportal.image" (dict "Values" .Values "service" "uat") }}"
           imagePullPolicy: "{{ .Values.uat.pullPolicy }}"
+          securityContext:
+{{ toYaml .Values.uat.containerSecurityContext | indent 12}}
           ports:
             - containerPort: 9999
               protocol: TCP

reportportal/templates/service-index/index-deployment.yaml

@@ -35,6 +35,8 @@ spec:
       - name: {{ $.Values.serviceindex.name | default "index" }}
         image: "{{ include "reportportal.image" (dict "Values" .Values "service" "serviceindex") }}"
         imagePullPolicy: "{{ .Values.serviceindex.pullPolicy }}"
+        securityContext:
+{{ toYaml .Values.serviceindex.containerSecurityContext | indent 10}}
         env:
         - name: K8S_MODE
           value: "true"

reportportal/templates/service-jobs/jobs-deployment.yaml

@@ -28,6 +28,8 @@ spec:
       - name: migrations-waiting-init
         image: "{{ include "reportportal.image" (dict "Values" .Values "service" "k8sWaitFor") }}"
         imagePullPolicy: IfNotPresent
+        securityContext:
+{{ toYaml .Values.servicejobs.containerSecurityContext | indent 10}}
         args:
           - "job-wr"
           - {{ include "reportportal.fullname" . }}-migrations
@@ -45,6 +47,8 @@ spec:
       - name: "{{ $.Values.servicejobs.name | default "jobs" }}"
         image: "{{ include "reportportal.image" (dict "Values" .Values "service" "servicejobs") }}"
         imagePullPolicy: "{{ .Values.servicejobs.pullPolicy }}"
+        securityContext:
+{{ toYaml .Values.servicejobs.containerSecurityContext | indent 10}}
         ports:
         - containerPort: 8686
           protocol: TCP

reportportal/templates/service-migrations/migrations-job.yaml

@@ -67,6 +67,8 @@ spec:
         {{- end }}
         image: "{{ include "reportportal.image" (dict "Values" .Values "service" "migrations") }}"
         imagePullPolicy: "{{ .Values.migrations.pullPolicy }}"
+        securityContext:
+{{ toYaml .Values.migrations.containerSecurityContext | indent 10}}
         name: migrations
         resources:
           requests:

reportportal/templates/service-ui/ui-deployment.yaml

@@ -32,6 +32,8 @@ spec:
       - name: {{ $.Values.serviceui.name | default "ui" }}
         image: "{{ include "reportportal.image" (dict "Values" .Values "service" "serviceui") }}"
         imagePullPolicy: "{{ .Values.serviceui.pullPolicy }}"
+        securityContext:
+{{ toYaml .Values.serviceui.containerSecurityContext | indent 10}}
         env:
         - name: RP_SERVER_PORT
           value: "8080"

reportportal/templates/statefullset-auto-analyzer/analyzer-statefulset.yaml

@@ -29,6 +29,8 @@ spec:
       - name: migrations-waiting-init
         image: "{{ include "reportportal.image" (dict "Values" .Values "service" "k8sWaitFor") }}"
         imagePullPolicy: IfNotPresent
+        securityContext:
+{{ toYaml .Values.serviceanalyzer.containerSecurityContext | indent 10}}
         args:
           - "pod-wr"
           - "-lcomponent={{ include "reportportal.fullname" . }}-api"
@@ -46,6 +48,8 @@ spec:
       - name: "{{ $.Values.serviceanalyzer.name | default "analyzer" }}"
         image: "{{ include "reportportal.image" (dict "Values" .Values "service" "serviceanalyzer") }}"
         imagePullPolicy: "{{ .Values.serviceanalyzer.pullPolicy }}"
+        securityContext:
+{{ toYaml .Values.serviceanalyzer.containerSecurityContext | indent 10}}
         ports:
         - containerPort: 5001
           name: analyzercore

reportportal/templates/statefullset-auto-analyzer/analyzertrain-statefulset.yaml

@@ -29,6 +29,8 @@ spec:
       - name: migrations-waiting-init
         image: "{{ include "reportportal.image" (dict "Values" .Values "service" "k8sWaitFor") }}"
         imagePullPolicy: IfNotPresent
+        securityContext:
+{{ toYaml .Values.serviceanalyzertrain.containerSecurityContext | indent 10}}
         args:
           - "pod-wr"
           - "-lcomponent={{ include "reportportal.fullname" . }}-api"
@@ -46,6 +48,8 @@ spec:
       - name: "{{ $.Values.serviceanalyzertrain.name | default "analyzer-train" }}"
         image: "{{ include "reportportal.image" (dict "Values" .Values "service" "serviceanalyzer") }}"
         imagePullPolicy: "{{ .Values.serviceanalyzertrain.pullPolicy }}"
+        securityContext:
+{{ toYaml .Values.serviceanalyzertrain.containerSecurityContext | indent 10}}
         ports:
         - containerPort: 5001
           name: analyzertrain

reportportal/templates/statefullset-auto-analyzer/metrics-gatherer-deployment.yaml

@@ -28,6 +28,8 @@ spec:
       - name: migrations-waiting-init
         image: "{{ include "reportportal.image" (dict "Values" .Values "service" "k8sWaitFor") }}"
         imagePullPolicy: IfNotPresent
+        securityContext:
+{{ toYaml .Values.metricsgatherer.containerSecurityContext | indent 10}}
         args:
           - "pod-wr"
           - "-lcomponent={{ include "reportportal.fullname" . }}-api"
@@ -45,6 +47,8 @@ spec:
       - name: metrics-gatherer
         image: "{{ include "reportportal.image" (dict "Values" .Values "service" "metricsgatherer") }}"
         imagePullPolicy: "{{ .Values.metricsgatherer.pullPolicy }}"
+        securityContext:
+{{ toYaml .Values.metricsgatherer.containerSecurityContext | indent 10}}
         ports:
         - containerPort: 5000
           name: metricsgatherer

reportportal/values.yaml

@@ -33,6 +33,7 @@ serviceindex:
   podLabels: {}
   podAnnotations: {}
   securityContext: {}
+  containerSecurityContext: {}
   serviceAccountName: ""
   ## @param serviceindex.nodeSelector define which Nodes the Pods are scheduled on.
   ## You can choose compute classes for GKE Autopilot Pods https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-compute-classes
@@ -67,6 +68,7 @@ serviceui:
   podLabels: {}
   podAnnotations: {}
   securityContext: {}
+  containerSecurityContext: {}
   ## @param serviceui.nodeSelector define which Nodes the Pods are scheduled on.
   ## You can choose compute classes for GKE Autopilot Pods https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-compute-classes
   ## Use cloud.google.com/compute-class: "COMPUTE_CLASS" for specific GKE Autopilot compute class.
@@ -188,6 +190,7 @@ serviceapi:
   podLabels: {}
   podAnnotations: {}
   securityContext: {}
+  containerSecurityContext: {}
 
   ## @param serviceapi.nodeSelector define which Nodes the Pods are scheduled on.
   ## You can choose compute classes for GKE Autopilot Pods https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-compute-classes
@@ -392,6 +395,7 @@ servicejobs:
   podLabels: {}
   podAnnotations: {}
   securityContext: {}
+  containerSecurityContext: {}
 
   ## @param servicejobs.nodeSelector define which Nodes the Pods are scheduled on.
   ## You can choose compute classes for GKE Autopilot Pods https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-compute-classes
@@ -427,6 +431,7 @@ serviceanalyzer:
   podLabels: {}
   podAnnotations: {}
   securityContext: {}
+  containerSecurityContext: {}
 
   ## @param serviceanalyzer.extraEnvs define the extra environment variables
   ##
@@ -469,6 +474,7 @@ serviceanalyzertrain:
   podLabels: {}
   podAnnotations: {}
   securityContext: {}
+  containerSecurityContext: {}
 
   ## @param serviceanalyzertrain.extraEnvs define the extra environment variables
   extraEnvs: []
@@ -518,6 +524,7 @@ metricsgatherer:
   podLabels: {}
   podAnnotations: {}
   securityContext: {}
+  containerSecurityContext: {}
 
   ## @param metricsgatherer.extraEnvs define the extra environment variables
   extraEnvs: []
@@ -558,6 +565,7 @@ migrations:
   podLabels: {}
   podAnnotations: {}
   securityContext: {}
+  containerSecurityContext: {}
 
   ## @param migrations.nodeSelector define which Nodes the Pods are scheduled on.
   ## You can choose compute classes for GKE Autopilot Pods https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-compute-classes