Item: hitachienergy#893, Updated K8s dashboard deployment

toszo · Mar 2, 2020 · fe7c4bd · fe7c4bd
1 parent bb0752c
commit fe7c4bd
Show file tree

Hide file tree

Showing 5 changed files with 31 additions and 16 deletions.
diff --git a/...ta/common/ansible/playbooks/roles/kubernetes_master/templates/kubernetes-dashboard.yml.j2 b/...ta/common/ansible/playbooks/roles/kubernetes_master/templates/kubernetes-dashboard.yml.j2
@@ -188,7 +188,7 @@ spec:
     spec:
       containers:
         - name: kubernetes-dashboard
-          image: {{ image_registry_address }}/kubernetesui/dashboard:v2.0.0-beta1
+          image: {{ image_registry_address }}/kubernetesui/dashboard:v2.0.0-beta8
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8443
@@ -213,6 +213,11 @@ spec:
               port: 8443
             initialDelaySeconds: 30
             timeoutSeconds: 30
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsUser: 1001
+            runAsGroup: 2001
       volumes:
         - name: kubernetes-dashboard-certs
           secret:
@@ -260,10 +265,12 @@ spec:
     metadata:
       labels:
         k8s-app: kubernetes-metrics-scraper
+      annotations:
+        seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
     spec:
       containers:
         - name: kubernetes-metrics-scraper
-          image: {{ image_registry_address }}/kubernetesui/metrics-scraper:v1.0.0
+          image: {{ image_registry_address }}/kubernetesui/metrics-scraper:v1.0.1
           ports:
             - containerPort: 8000
               protocol: TCP
@@ -274,8 +281,19 @@ spec:
               port: 8000
             initialDelaySeconds: 30
             timeoutSeconds: 30
+          volumeMounts:
+          - mountPath: /tmp
+            name: tmp-volume
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsUser: 1001
+            runAsGroup: 2001
       serviceAccountName: kubernetes-dashboard
       # Comment the following tolerations if Dashboard must not be deployed on master
       tolerations:
         - key: node-role.kubernetes.io/master
-          effect: NoSchedule
+          effect: NoSchedule
+      volumes:
+        - name: tmp-volume
+          emptyDir: {}
diff --git a/.../ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.txt b/.../ansible/playbooks/roles/repository/files/download-requirements/centos-7/requirements.txt
@@ -164,8 +164,8 @@ quay.io/coreos/flannel:v0.11.0-amd64
 quay.io/coreos/flannel:v0.11.0
 calico/node:v3.8.1
 calico/pod2daemon-flexvol:v3.8.1
-kubernetesui/dashboard:v2.0.0-beta1
-kubernetesui/metrics-scraper:v1.0.0
+kubernetesui/dashboard:v2.0.0-beta8
+kubernetesui/metrics-scraper:v1.0.1
 calico/cni:v3.8.1
 calico/kube-controllers:v3.8.1
 registry:2

diff --git a/.../ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.txt b/.../ansible/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.txt
@@ -161,8 +161,8 @@ quay.io/coreos/flannel:v0.11.0-amd64
 quay.io/coreos/flannel:v0.11.0
 calico/node:v3.8.1
 calico/pod2daemon-flexvol:v3.8.1
-kubernetesui/dashboard:v2.0.0-beta1
-kubernetesui/metrics-scraper:v1.0.0
+kubernetesui/dashboard:v2.0.0-beta8
+kubernetesui/metrics-scraper:v1.0.1
 calico/cni:v3.8.1
 calico/kube-controllers:v3.8.1
 registry:2

diff --git a/...ible/playbooks/roles/repository/files/download-requirements/ubuntu-18.04/requirements.txt b/...ible/playbooks/roles/repository/files/download-requirements/ubuntu-18.04/requirements.txt
@@ -185,8 +185,8 @@ quay.io/coreos/flannel:v0.11.0-amd64
 quay.io/coreos/flannel:v0.11.0
 calico/node:v3.8.1
 calico/pod2daemon-flexvol:v3.8.1
-kubernetesui/dashboard:v2.0.0-beta1
-kubernetesui/metrics-scraper:v1.0.0
+kubernetesui/dashboard:v2.0.0-beta8
+kubernetesui/metrics-scraper:v1.0.1
 calico/cni:v3.8.1
 calico/kube-controllers:v3.8.1
 registry:2
@@ -212,23 +212,20 @@ k8s.gcr.io/kube-apiserver:v1.13.12
 k8s.gcr.io/kube-controller-manager:v1.13.12
 k8s.gcr.io/kube-proxy:v1.13.12
 k8s.gcr.io/kube-scheduler:v1.13.12
-
 ## v1.15.10
 k8s.gcr.io/kube-proxy:v1.15.10
 k8s.gcr.io/kube-apiserver:v1.15.10
 k8s.gcr.io/kube-controller-manager:v1.15.10
 k8s.gcr.io/kube-scheduler:v1.15.10
 k8s.gcr.io/coredns:1.3.1
 k8s.gcr.io/etcd:3.3.10
-
 ## 1.16.7
 k8s.gcr.io/kube-scheduler:v1.16.7
 k8s.gcr.io/kube-proxy:v1.16.7
 k8s.gcr.io/kube-apiserver:v1.16.7
 k8s.gcr.io/kube-controller-manager:v1.16.7
 k8s.gcr.io/etcd:3.3.15-0
 k8s.gcr.io/coredns:1.6.2
-
 ## v1.17.3
 k8s.gcr.io/kube-apiserver:v1.17.3
 k8s.gcr.io/kube-controller-manager:v1.17.3

diff --git a/core/src/epicli/data/common/defaults/configuration/image-registry.yml b/core/src/epicli/data/common/defaults/configuration/image-registry.yml
@@ -32,10 +32,10 @@ specification:
       file_name: node-v3.8.1.tar
     - name: "calico/pod2daemon-flexvol:v3.8.1"
       file_name: pod2daemon-flexvol-v3.8.1.tar
-    - name: "kubernetesui/dashboard:v2.0.0-beta1"
-      file_name: dashboard-v2.0.0-beta1.tar
-    - name: "kubernetesui/metrics-scraper:v1.0.0"
-      file_name: metrics-scraper-v1.0.0.tar
+    - name: "kubernetesui/dashboard:v2.0.0-beta8"
+      file_name: dashboard-v2.0.0-beta8.tar
+    - name: "kubernetesui/metrics-scraper:v1.0.1"
+      file_name: metrics-scraper-v1.0.1.tar
     - name: "calico/cni:v3.8.1"
       file_name: cni-v3.8.1.tar
     - name: "calico/kube-controllers:v3.8.1"