[stable/nginx-ingress] Add variable for allowPrivilegeEscalation (#12…

…435) * Add allowPrivilegeEscalation as variable Adds variable for allowPrivilegeEscalation which allows to use NET_BIND_SERVICE with a PodSecurityPolicy which forbids privilege escalation. Signed-off-by: Markus Blaschke <[email protected]> * Set allowPrivilegeEscalation to true Should be enabled as NET_BIND_SERVICE is active by default Signed-off-by: Markus Blaschke <[email protected]>
dmitry-j-mikhin · Jul 23, 2019 · 1a89585 · 1a89585
1 parent 32700cb
commit 1a89585
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 1 deletion.
diff --git a/wallarm-ingress/Chart.yaml b/wallarm-ingress/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: nginx-ingress
-version: 1.11.0
+version: 1.11.1
 appVersion: 0.25.0
 home: https://github.com/kubernetes/ingress-nginx
 description: An nginx Ingress controller that uses ConfigMap to store the nginx configuration.

diff --git a/wallarm-ingress/templates/controller-daemonset.yaml b/wallarm-ingress/templates/controller-daemonset.yaml
@@ -95,6 +95,7 @@ spec:
                 add:
                 - NET_BIND_SERVICE
             runAsUser: {{ .Values.controller.image.runAsUser }}
+            allowPrivilegeEscalation: {{ .Values.controller.image.allowPrivilegeEscalation }}
           {{- end }}
           env:
             - name: POD_NAME

diff --git a/wallarm-ingress/templates/controller-deployment.yaml b/wallarm-ingress/templates/controller-deployment.yaml
@@ -95,6 +95,7 @@ spec:
                 add:
                 - NET_BIND_SERVICE
             runAsUser: {{ .Values.controller.image.runAsUser }}
+            allowPrivilegeEscalation: {{ .Values.controller.image.allowPrivilegeEscalation }}
           {{- end }}
           env:
             - name: POD_NAME

diff --git a/wallarm-ingress/values.yaml b/wallarm-ingress/values.yaml
@@ -9,6 +9,7 @@ controller:
     pullPolicy: IfNotPresent
     # www-data -> uid 33
     runAsUser: 33
+    allowPrivilegeEscalation: true
 
   # Configures the ports the nginx-controller listens on
   containerPort: