feat:separate exporter's securityContext

apecloud · Jan 15, 2025 · a6011df · a6011df
1 parent 428c7bd
commit a6011df
Show file tree

Hide file tree

Showing 6 changed files with 18 additions and 12 deletions.
diff --git a/addons/kafka/templates/cmpd-broker-27.yaml b/addons/kafka/templates/cmpd-broker-27.yaml
@@ -230,9 +230,9 @@ spec:
       - name: jmx-exporter
         image: {{ .Values.images.registry | default "docker.io" }}/{{ .Values.images.jmxExporter.repository }}:{{ .Values.images.jmxExporter.tag }}
         imagePullPolicy: {{ default "IfNotPresent" .Values.images.pullPolicy }}
-        {{- if .Values.container.securityContext }}
+        {{- if .Values.exporter.securityContext }}
         securityContext:
-          {{- toYaml .Values.container.securityContext | nindent 10 }}
+          {{- toYaml .Values.exporter.securityContext | nindent 10 }}
         {{- end }}
         command:
           - java

diff --git a/addons/kafka/templates/cmpd-broker.yaml b/addons/kafka/templates/cmpd-broker.yaml
@@ -230,9 +230,9 @@ spec:
       - name: jmx-exporter
         image: {{ .Values.images.registry | default "docker.io" }}/{{ .Values.images.jmxExporter.repository }}:{{ .Values.images.jmxExporter.tag }}
         imagePullPolicy: {{ default "IfNotPresent" .Values.images.pullPolicy }}
-        {{- if .Values.container.securityContext }}
+        {{- if .Values.exporter.securityContext }}
         securityContext:
-          {{- toYaml .Values.container.securityContext | nindent 10 }}
+          {{- toYaml .Values.exporter.securityContext | nindent 10 }}
         {{- end }}
         command:
           - java

diff --git a/addons/kafka/templates/cmpd-combine.yaml b/addons/kafka/templates/cmpd-combine.yaml
@@ -221,9 +221,9 @@ spec:
       - name: jmx-exporter
         image: {{ .Values.images.registry | default "docker.io" }}/{{ .Values.images.jmxExporter.repository }}:{{ .Values.images.jmxExporter.tag }}
         imagePullPolicy: {{ default "IfNotPresent" .Values.images.pullPolicy }}
-        {{- if .Values.container.securityContext }}
+        {{- if .Values.exporter.securityContext }}
         securityContext:
-          {{- toYaml .Values.container.securityContext | nindent 10 }}
+          {{- toYaml .Values.exporter.securityContext | nindent 10 }}
         {{- end }}
         command:
           - java

diff --git a/addons/kafka/templates/cmpd-controller.yaml b/addons/kafka/templates/cmpd-controller.yaml
@@ -157,9 +157,9 @@ spec:
       - name: jmx-exporter
         image: {{ .Values.images.registry | default "docker.io" }}/{{ .Values.images.jmxExporter.repository }}:{{ .Values.images.jmxExporter.tag }}
         imagePullPolicy: {{ default "IfNotPresent" .Values.images.pullPolicy }}
-        {{- if .Values.container.securityContext }}
+        {{- if .Values.exporter.securityContext }}
         securityContext:
-          {{- toYaml .Values.container.securityContext | nindent 10 }}
+          {{- toYaml .Values.exporter.securityContext | nindent 10 }}
         {{- end }}
         command:
           - java

diff --git a/addons/kafka/templates/cmpd-exporter.yaml b/addons/kafka/templates/cmpd-exporter.yaml
@@ -51,10 +51,10 @@ spec:
     - name: kafka-exporter
       image: {{ .Values.images.registry | default "docker.io" }}/{{ .Values.images.kafkaExporter.repository }}:{{ .Values.images.kafkaExporter.tag }}
       imagePullPolicy: {{ default "IfNotPresent" .Values.images.pullPolicy }}
-        {{- if .Values.container.securityContext }}
-        securityContext:
-          {{- toYaml .Values.container.securityContext | nindent 10 }}
-        {{- end }}
+      {{- if .Values.exporter.securityContext }}
+      securityContext:
+        {{- toYaml .Values.exporter.securityContext | nindent 8 }}
+      {{- end }}
       env:
         - name: SERVICE_PORT
           value: "9308"

diff --git a/addons/kafka/values.yaml b/addons/kafka/values.yaml
@@ -73,5 +73,11 @@ securityContext:
 container:
   securityContext:
     allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    runAsUser: 1001
+
+## exporter security context settings
+exporter:
+  securityContext:
     runAsNonRoot: true
     runAsUser: 1001