Merge pull request #1073 from javanthropus/add-security-context

Lock down package server runtime environment

Author: openshift-merge-robot

deploy/chart/templates/_packageserver.deployment-spec.yaml

@@ -60,5 +60,15 @@ spec:
         {{- if .Values.package.resources }}
         resources:
 {{ toYaml .Values.package.resources | indent 10 }}
-        {{- end}}
+        {{- end }}
+        {{- if .Values.package.securityContext }}
+        securityContext:
+          runAsUser: {{ .Values.package.securityContext.runAsUser }}
+        {{- end }}
+        volumeMounts:
+        - name: tmpfs
+          mountPath: /tmp
+      volumes:
+      - name: tmpfs
+        emptyDir: {}
 {{- end -}}

deploy/upstream/values.yaml

@@ -27,5 +27,7 @@ package:
     pullPolicy: Always
   service:
     internalPort: 5443
+  securityContext:
+    runAsUser: 1000
 catalog_sources:
 - rh-operators

manifests/0000_50_olm_15-packageserver.clusterserviceversion.yaml

@@ -123,6 +123,12 @@ spec:
                   requests:
                     cpu: 10m
                     memory: 50Mi
+                volumeMounts:
+                - name: tmpfs
+                  mountPath: /tmp
+              volumes:
+              - name: tmpfs
+                emptyDir: {}
   maturity: alpha
   version: 0.14.1
   apiservicedefinitions: