diff --git a/charts/flyteagent/README.md b/charts/flyteagent/README.md index 9db05060d0e..d0f417b85be 100644 --- a/charts/flyteagent/README.md +++ b/charts/flyteagent/README.md @@ -26,11 +26,13 @@ A Helm chart for Flyte agent | podAnnotations | object | `{}` | Annotations for flyteagent pods | | podEnv | object | `{}` | Additional flyteagent pod container environment variables | | podLabels | object | `{}` | Labels for flyteagent pods | +| podSecurityContext | object | `{"seLinuxOptions":{"type":"spc_t"}}` | Security context for pod | | ports.containerPort | int | `8000` | | | ports.name | string | `"agent-grpc"` | | | priorityClassName | string | `""` | Sets priorityClassName for datacatalog pod(s). | | replicaCount | int | `1` | Replicas count for flyteagent deployment | | resources | object | `{"limits":{"cpu":"500m","ephemeral-storage":"200Mi","memory":"200Mi"},"requests":{"cpu":"500m","ephemeral-storage":"200Mi","memory":"200Mi"}}` | Default resources requests and limits for flyteagent deployment | +| securityContext | object | `{"allowPrivilegeEscalation":false}` | Security context for container | | service | object | `{"annotations":{"projectcontour.io/upstream-protocol.h2c":"grpc"},"type":"ClusterIP"}` | Service settings for flyteagent | | serviceAccount | object | `{"annotations":{},"create":true,"imagePullSecrets":[]}` | Configuration for service accounts for flyteagent | | serviceAccount.annotations | object | `{}` | Annotations for ServiceAccount attached to flyteagent pods | diff --git a/charts/flyteagent/templates/agent/deployment.yaml b/charts/flyteagent/templates/agent/deployment.yaml index 82359cec642..da5c93a2c7b 100644 --- a/charts/flyteagent/templates/agent/deployment.yaml +++ b/charts/flyteagent/templates/agent/deployment.yaml @@ -19,6 +19,8 @@ spec: {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }} {{- end }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: - command: - pyflyte @@ -36,6 +38,8 @@ spec: ports: - containerPort: {{ .Values.ports.containerPort }} name: {{ .Values.ports.name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} resources: {{- toYaml .Values.resources | nindent 10 }} {{- with .Values.additionalVolumeMounts -}} {{ tpl (toYaml .) $ | nindent 8 }} diff --git a/charts/flyteagent/values.yaml b/charts/flyteagent/values.yaml index b682600d464..b3cc55d6005 100755 --- a/charts/flyteagent/values.yaml +++ b/charts/flyteagent/values.yaml @@ -54,6 +54,13 @@ serviceAccount: annotations: {} # -- ImagePullSecrets to automatically assign to the service account imagePullSecrets: [] +# -- Security context for pod +podSecurityContext: + seLinuxOptions: + type: spc_t +# -- Security context for container +securityContext: + allowPrivilegeEscalation: false # -- Annotations for flyteagent pods podAnnotations: {} # -- Additional flyteagent pod container environment variables diff --git a/deployment/agent/flyte_agent_helm_generated.yaml b/deployment/agent/flyte_agent_helm_generated.yaml index a74aad0d9cd..596fd38fb0e 100644 --- a/deployment/agent/flyte_agent_helm_generated.yaml +++ b/deployment/agent/flyte_agent_helm_generated.yaml @@ -71,6 +71,9 @@ spec: helm.sh/chart: flyteagent-v0.1.10 app.kubernetes.io/managed-by: Helm spec: + securityContext: + seLinuxOptions: + type: spc_t containers: - command: - pyflyte @@ -84,6 +87,8 @@ spec: ports: - containerPort: 8000 name: agent-grpc + securityContext: + allowPrivilegeEscalation: false resources: limits: cpu: 500m