Dataport: Anpassung der Helm-Charts gemäß den Kyverno Richtlinien bei Dataport

Enrichtung eines Service Accounts
Einrichtung der Livenes-probes
Einrichtung des Securitycontext
nach dem Vorbild des Alfa Helm-Charts

src/main/helm/templates/_helpers.tpl

@@ -38,7 +38,9 @@ app.kubernetes.io/namespace: {{ include "app.namespace" . }}
 {{- define "app.ssoRealm" -}}
 {{ printf "%s-%s-%s" (include "app.ozgcloudBundesland" .) ( include "app.ozgcloudBezeichner" . ) ( include "app.ozgcloudEnvironment" . ) | trunc 63 | trimSuffix "-" }}
 {{- end -}}
-
+{{- define "app.serviceAccountName" -}}
+{{ printf "%s" ( (.Values.serviceAccount).name | default "administration-service-account" ) }}
+{{- end -}}
 {{- define "app.ozgcloudBundesland" -}}
 {{- required "Bundesland muss angegeben sein" (.Values.ozgcloud).bundesland }}
 {{- end -}}

src/main/helm/templates/deployment.yaml

@@ -48,6 +48,9 @@ spec:
         {{- include "app.defaultLabels" . | indent 8 }}
         component: {{ .Release.Name }}
     spec:
+      {{- if (.Values.serviceAccount).create }}
+      serviceAccountName: {{ include "app.serviceAccountName" . }}
+      {{- end }}
       topologySpreadConstraints:
       - maxSkew: 1
         topologyKey: kubernetes.io/hostname
@@ -142,6 +145,17 @@ spec:
           periodSeconds: 10
           successThreshold: 1
           timeoutSeconds: 5
+        {{- if .Values.enableLivenessProbe }}
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /actuator/health/liveness
+            port: 8081
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 3
+        {{- end }}
         resources:
         {{- with .Values.resources }}
 {{ toYaml . | indent 10 }}
@@ -151,6 +165,16 @@ spec:
           privileged: false
           readOnlyRootFilesystem: false
           runAsNonRoot: true
+          {{- with (.Values.securityContext).runAsUser }}
+          runAsUser: {{ . }}
+          {{- end }}
+          {{- with (.Values.securityContext).runAsGroup }}
+          runAsGroup: {{ . }}
+          {{- end }}
+          {{- with (.Values.securityContext).capabilities }}
+          capabilities:
+{{ toYaml . | indent 12 }}
+          {{- end }}
         stdin: true
         terminationMessagePath: /dev/termination-log
         terminationMessagePolicy: File
@@ -178,5 +202,8 @@ spec:
         - name: {{ required "image-pull-secret must be set" .Values.imagePullSecret }}
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 300000000
+      {{- with .Values.podSecurityContext }}
+      securityContext:
\ No newline at end of file
+{{ toYaml . | indent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: 30