vdaas · kpango · Jan 18, 2021 · Nov 12, 2020 · Nov 12, 2020 · Jan 18, 2021
diff --git a/.github/kubelinter.yaml b/.github/kubelinter.yaml
@@ -18,3 +18,4 @@ checks:
   exclude:
     - "unset-cpu-requirements"
     - "unset-memory-requirements"
+    - "no-read-only-root-fs"
diff --git a/.github/workflows/reviewdog-k8s.yml b/.github/workflows/reviewdog-k8s.yml
@@ -18,13 +18,15 @@ name: "reviewdog - K8s manifests"
 on:
   pull_request:
     paths:
+      - "charts/**"
       - "k8s/**"
 
 jobs:
   kubeval-conflint:
     name: runner / kubeval-conflint
     runs-on: ubuntu-latest
-    container: mumoshu/conflint:latest
+    container:
+      image: mumoshu/conflint:latest
     steps:
       - uses: actions/checkout@v2
       - name: kubeval-conflint
@@ -36,17 +38,29 @@ jobs:
           CONFLINT_LOG: DEBUG
           REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           REPORTER: github-pr-review
-  kubelinter:
+  kubelinter-k8s-manifests:
     name: runner / kubelinter
     runs-on: ubuntu-latest
+    container:
+      image: vdaas/vald-ci-container:nightly
     steps:
       - uses: actions/checkout@v2
-      - name: setup-kubelinter
+      - name: kubelinter for k8s directory
         run: |
-          wget https://github.com/stackrox/kube-linter/releases/download/${KUBELINTER_VERSION}/kube-linter-linux.zip
-          unzip kube-linter-linux.zip
-        env:
-          KUBELINTER_VERSION: 0.1.2
-      - name: kubelinter
+          kube-linter lint \
+            --config .github/kubelinter.yaml \
+            k8s/agent \
+            k8s/discoverer \
+            k8s/gateway \
+            k8s/manager \
+            k8s/meta
+  kubelinter-vald-chart:
+    name: runner / kubelinter for vald chart
+    runs-on: ubuntu-latest
+    container:
+      image: vdaas/vald-ci-container:nightly
+    steps:
+      - uses: actions/checkout@v2
+      - name: kubelinter for generated manifests
         run: |
-          ./kube-linter lint --config .github/kubelinter.yaml k8s
+          kube-linter lint charts/vald
diff --git a/Makefile b/Makefile
@@ -64,6 +64,7 @@ HELM_VERSION         ?= v3.4.2
 HELM_DOCS_VERSION    ?= 1.4.0
 VALDCLI_VERSION      ?= v0.0.62
 TELEPRESENCE_VERSION ?= 0.108
+KUBELINTER_VERSION   ?= 0.1.6
 
 SWAP_DEPLOYMENT_TYPE ?= deployment
 SWAP_IMAGE           ?= ""

diff --git a/Makefile.d/k8s.mk b/Makefile.d/k8s.mk
@@ -419,3 +419,25 @@ telepresence/swap/backup-gateway:
 ## swap meta-gateway deployment using telepresence
 telepresence/swap/meta-gateway:
 	@$(call telepresence,vald-meta-gateway,vdaas/vald-meta-gateway)
+
+.PHONY: kubelinter/install
+## install kubelinter
+kubelinter/install: $(BINDIR)/kube-linter
+
+ifeq ($(UNAME),Darwin)
+$(BINDIR)/kube-linter:
+	mkdir -p $(BINDIR)
+	cd $(TEMP_DIR) \
+	    && curl -LO https://github.com/stackrox/kube-linter/releases/download/$(KUBELINTER_VERSION)/kube-linter-darwin.zip \
+	    && unzip kube-linter-darwin.zip \
+	    && chmod a+x kube-linter \
+	    && mv kube-linter $(BINDIR)/kube-linter
+else
+$(BINDIR)/kube-linter:
+	mkdir -p $(BINDIR)
+	cd $(TEMP_DIR) \
+	    && curl -LO https://github.com/stackrox/kube-linter/releases/download/$(KUBELINTER_VERSION)/kube-linter-linux.zip \
+	    && unzip kube-linter-linux.zip \
+	    && chmod a+x kube-linter \
+	    && mv kube-linter $(BINDIR)/kube-linter
+endif
diff --git a/charts/vald/templates/agent/daemonset.yaml b/charts/vald/templates/agent/daemonset.yaml
@@ -136,7 +136,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if .Values.agent.securityContext }}
+      securityContext:
+        {{- toYaml .Values.agent.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ .Values.agent.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ .Values.agent.name }}-config

diff --git a/charts/vald/templates/agent/deployment.yaml b/charts/vald/templates/agent/deployment.yaml
@@ -141,7 +141,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if .Values.agent.securityContext }}
+      securityContext:
+        {{- toYaml .Values.agent.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ .Values.agent.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ .Values.agent.name }}-config

diff --git a/charts/vald/templates/agent/statefulset.yaml b/charts/vald/templates/agent/statefulset.yaml
@@ -157,7 +157,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if .Values.agent.securityContext }}
+      securityContext:
+        {{- toYaml .Values.agent.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ .Values.agent.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ .Values.agent.name }}-config

diff --git a/charts/vald/templates/discoverer/daemonset.yaml b/charts/vald/templates/discoverer/daemonset.yaml
@@ -90,7 +90,10 @@ spec:
       schedulerName: default-scheduler
       serviceAccount: vald
       serviceAccountName: vald
-      securityContext: {}
+      {{- if $discoverer.securityContext }}
+      securityContext:
+        {{- toYaml $discoverer.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $discoverer.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ $discoverer.name }}-config

diff --git a/charts/vald/templates/discoverer/deployment.yaml b/charts/vald/templates/discoverer/deployment.yaml
@@ -93,9 +93,12 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      serviceAccount: vald
-      serviceAccountName: vald
-      securityContext: {}
+      serviceAccount: {{ $discoverer.serviceAccount.name }}
+      serviceAccountName: {{ $discoverer.serviceAccount.name }}
+      {{- if $discoverer.securityContext }}
+      securityContext:
+        {{- toYaml $discoverer.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $discoverer.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ $discoverer.name }}-config

diff --git a/charts/vald/templates/gateway/backup/daemonset.yaml b/charts/vald/templates/gateway/backup/daemonset.yaml
@@ -88,7 +88,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $gateway.securityContext }}
+      securityContext:
+        {{- toYaml $gateway.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $gateway.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ $gateway.name }}-config

diff --git a/charts/vald/templates/gateway/backup/deployment.yaml b/charts/vald/templates/gateway/backup/deployment.yaml
@@ -93,7 +93,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $gateway.securityContext }}
+      securityContext:
+        {{- toYaml $gateway.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $gateway.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ $gateway.name }}-config

diff --git a/charts/vald/templates/gateway/lb/daemonset.yaml b/charts/vald/templates/gateway/lb/daemonset.yaml
@@ -88,7 +88,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $gateway.securityContext }}
+      securityContext:
+        {{- toYaml $gateway.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $gateway.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ $gateway.name }}-config

diff --git a/charts/vald/templates/gateway/lb/deployment.yaml b/charts/vald/templates/gateway/lb/deployment.yaml
@@ -93,7 +93,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $gateway.securityContext }}
+      securityContext:
+        {{- toYaml $gateway.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $gateway.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ $gateway.name }}-config

diff --git a/charts/vald/templates/gateway/meta/daemonset.yaml b/charts/vald/templates/gateway/meta/daemonset.yaml
@@ -88,7 +88,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $gateway.securityContext }}
+      securityContext:
+        {{- toYaml $gateway.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $gateway.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ $gateway.name }}-config

diff --git a/charts/vald/templates/gateway/meta/deployment.yaml b/charts/vald/templates/gateway/meta/deployment.yaml
@@ -93,7 +93,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $gateway.securityContext }}
+      securityContext:
+        {{- toYaml $gateway.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $gateway.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ $gateway.name }}-config

diff --git a/charts/vald/templates/gateway/vald/daemonset.yaml b/charts/vald/templates/gateway/vald/daemonset.yaml
@@ -88,7 +88,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $gateway.securityContext }}
+      securityContext:
+        {{- toYaml $gateway.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $gateway.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ $gateway.name }}-config

diff --git a/charts/vald/templates/gateway/vald/deployment.yaml b/charts/vald/templates/gateway/vald/deployment.yaml
@@ -93,7 +93,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $gateway.securityContext }}
+      securityContext:
+        {{- toYaml $gateway.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $gateway.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ $gateway.name }}-config

diff --git a/charts/vald/templates/manager/backup/daemonset.yaml b/charts/vald/templates/manager/backup/daemonset.yaml
@@ -88,7 +88,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $backup.securityContext }}
+      securityContext:
+        {{- toYaml $backup.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $backup.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ $backup.name }}-config

diff --git a/charts/vald/templates/manager/backup/deployment.yaml b/charts/vald/templates/manager/backup/deployment.yaml
@@ -93,7 +93,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $backup.securityContext }}
+      securityContext:
+        {{- toYaml $backup.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $backup.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ $backup.name }}-config

diff --git a/charts/vald/templates/manager/compressor/daemonset.yaml b/charts/vald/templates/manager/compressor/daemonset.yaml
@@ -88,7 +88,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $compressor.securityContext }}
+      securityContext:
+        {{- toYaml $compressor.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $compressor.terminationGracePeriodSeconds }}
       volumes:
         - configMap:

diff --git a/charts/vald/templates/manager/compressor/deployment.yaml b/charts/vald/templates/manager/compressor/deployment.yaml
@@ -93,7 +93,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $compressor.securityContext }}
+      securityContext:
+        {{- toYaml $compressor.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $compressor.terminationGracePeriodSeconds }}
       volumes:
         - configMap:

diff --git a/charts/vald/templates/manager/index/daemonset.yaml b/charts/vald/templates/manager/index/daemonset.yaml
@@ -88,7 +88,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $index.securityContext }}
+      securityContext:
+        {{- toYaml $index.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $index.terminationGracePeriodSeconds }}
       volumes:
         - configMap:

diff --git a/charts/vald/templates/manager/index/deployment.yaml b/charts/vald/templates/manager/index/deployment.yaml
@@ -91,7 +91,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $index.securityContext }}
+      securityContext:
+        {{- toYaml $index.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $index.terminationGracePeriodSeconds }}
       volumes:
         - configMap:

diff --git a/charts/vald/templates/meta/daemonset.yaml b/charts/vald/templates/meta/daemonset.yaml
@@ -88,7 +88,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $meta.securityContext }}
+      securityContext:
+        {{- toYaml $meta.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $meta.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ $meta.name }}-config

diff --git a/charts/vald/templates/meta/deployment.yaml b/charts/vald/templates/meta/deployment.yaml
@@ -93,7 +93,10 @@ spec:
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      securityContext: {}
+      {{- if $meta.securityContext }}
+      securityContext:
+        {{- toYaml $meta.securityContext | nindent 8 }}
+      {{- end }}
       terminationGracePeriodSeconds: {{ $meta.terminationGracePeriodSeconds }}
       volumes:
         - name: {{ $meta.name }}-config

diff --git a/charts/vald/values.schema.json b/charts/vald/values.schema.json