mirror of
https://github.com/puppetmaster/typhoon.git
synced 2024-12-26 06:19:33 +01:00
5eb4078d68
* Annotate pods, deployments, and daemonsets to start containers with the Docker runtime's default seccomp profile * Overrides Kubernetes default behavior which started containers with seccomp=unconfined * https://docs.docker.com/engine/security/seccomp/#pass-a-profile-for-a-container
62 lines
1.6 KiB
YAML
62 lines
1.6 KiB
YAML
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: container-linux-update-agent
|
|
namespace: reboot-coordinator
|
|
spec:
|
|
updateStrategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 1
|
|
selector:
|
|
matchLabels:
|
|
app: container-linux-update-agent
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: container-linux-update-agent
|
|
annotations:
|
|
seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
|
|
spec:
|
|
containers:
|
|
- name: update-agent
|
|
image: quay.io/coreos/container-linux-update-operator:v0.7.0
|
|
command:
|
|
- "/bin/update-agent"
|
|
volumeMounts:
|
|
- mountPath: /var/run/dbus
|
|
name: var-run-dbus
|
|
- mountPath: /etc/coreos
|
|
name: etc-coreos
|
|
- mountPath: /usr/share/coreos
|
|
name: usr-share-coreos
|
|
- mountPath: /etc/os-release
|
|
name: etc-os-release
|
|
env:
|
|
# read by update-agent as the node name to manage reboots for
|
|
- name: UPDATE_AGENT_NODE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.nodeName
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/master
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
volumes:
|
|
- name: var-run-dbus
|
|
hostPath:
|
|
path: /var/run/dbus
|
|
- name: etc-coreos
|
|
hostPath:
|
|
path: /etc/coreos
|
|
- name: usr-share-coreos
|
|
hostPath:
|
|
path: /usr/share/coreos
|
|
- name: etc-os-release
|
|
hostPath:
|
|
path: /etc/os-release
|