panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add tmp mount so that server can run locked down (#105)

Browse Source 
This pr adds a tmp mount to the spire server pod so that it can run with
read only root.

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2023-03-08 14:21:45 -08:00
committed by GitHub
parent aaaf2f7625
commit b6dd136af2
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/templates/statefulset.yaml
+5
View File
@@ -132,6 +132,9 @@ spec:
mountPath: /controller-manager-config.yaml mountPath: /controller-manager-config.yaml
subPath: controller-manager-config.yaml subPath: controller-manager-config.yaml
readOnly: true readOnly: true
- name: spire-controller-manager-tmp
mountPath: /tmp
readOnly: false
{{- end }} {{- end }}
{{- if gt (len .Values.extraContainers) 0 }} {{- if gt (len .Values.extraContainers) 0 }}
{{- toYaml .Values.extraContainers | nindent 8 }} {{- toYaml .Values.extraContainers | nindent 8 }}
@@ -158,6 +161,8 @@ spec:
name: {{ include "spire-server.fullname" . }} name: {{ include "spire-server.fullname" . }}
- name: spire-server-socket - name: spire-server-socket
emptyDir: {} emptyDir: {}
- name: spire-controller-manager-tmp
emptyDir: {}
{{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }} {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
- name: upstream-ca - name: upstream-ca
secret: secret: