Skip to content

Add freely configurable securityContext to deployment

Romuald Atchadé requested to merge freely-configurable-securitycontext into main

What does this MR do?

Continue the work started in !309 (closed)

Why was this MR needed?

Mostly rebase the and fix conflicts so the changes can be merged in the main branch

What's the best way to test this MR?

values.yaml 
image:
  registry: registry.gitlab.com
  image: gitlab-org/gitlab-runner
  # tag: alpine-v11.6.0

imagePullPolicy: IfNotPresent

replicas: 1

gitlabUrl: https://gitlab.com/

runnerRegistrationToken: "__TOKEN__"

terminationGracePeriodSeconds: 0

concurrent: 10

checkInterval: 30

logLevel: "debug"

sessionServer:
  enabled: false
  # annotations: {}
  # timeout: 1800
  # internalPort: 8093
  # externalPort: 9000
  # publicIP: ""
  # loadBalancerSourceRanges:
  #   - 1.2.3.4/32

## For RBAC support:
rbac:
  create: true
  rules: []
  clusterWideAccess: false
  serviceAccountAnnotations: {}
  podSecurityPolicy:
    enabled: false
    resourceNames:
    - gitlab-runner

metrics:
  enabled: true
  portName: metrics
  port: 9252
  serviceMonitor:
    enabled: false

service:
  enabled: false
  type: ClusterIP

runners:
  config: |
    [[runners]]
      [runners.kubernetes]
        namespace = "{{.Release.Namespace}}"
        image = "alpine"

  cache: {}
  builds: {}
  services: {}
  helpers: {}
  pod_security_context:
    run_as_non_root: true
    run_as_user: 100
    run_as_group: 100
    fs_group: 65533
    supplemental_groups: [101, 102]

securityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: false
  runAsNonRoot: true
  privileged: false
  capabilities:
    drop: ["ALL"]

podSecurityContext:
  runAsUser: 100
  # runAsGroup: 65533
  fsGroup: 65533
  # supplementalGroups: [65533]

  ## Note: values for the ubuntu image:
  # runAsUser: 999
  # fsGroup: 999

resources: {}

affinity: {}
nodeSelector: {}
tolerations: []
hostAliases: []
podAnnotations: {}
podLabels: {}
secrets: []
configMaps: {}
volumeMounts: []
volumes: []
  1. Install the chart
helm install -f values.yaml gitlab-runner .
  1. Run a job
  2. The job should run as expected
  3. Delete the chart
helm delete gitlab-runner

What are the relevant issue numbers?

close #305 (closed)

Edited by Romuald Atchadé

Merge request reports