Move Gateway security context from pod to container level
the securityContext doesn't need to be disabled when using Istio
@@ -22,11 +22,6 @@ spec:
{{- else }}
serviceAccountName: {{ .Release.Name }}-controller
{{- end }}
- {{- if .Values.securityContext }}
- securityContext:
- readOnlyRootFilesystem: true
- runAsUser: 10001
- {{- end }}
{{- if .Values.basic_auth }}
volumes:
- name: auth
@@ -37,6 +32,11 @@ spec:
- name: gateway
image: {{ .Values.gateway.image }}
imagePullPolicy: {{ .Values.openfaasImagePullPolicy }}
+ {{- if .Values.securityContext }}
+ securityContext:
+ readOnlyRootFilesystem: true
+ runAsUser: 10001
+ {{- end }}
livenessProbe:
httpGet:
path: /healthz
@@ -91,6 +91,11 @@ spec:
- name: operator
image: {{ .Values.operator.image }}
imagePullPolicy: Always
+ {{- if .Values.securityContext }}
+ securityContext:
+ readOnlyRootFilesystem: true
+ runAsUser: 10001
+ {{- end }}
command:
- ./openfaas-operator
- -logtostderr
