41 lines
2.1 KiB
Smarty
41 lines
2.1 KiB
Smarty
{{/*
|
||
检测是否为 Openshift 平台（true/false）
|
||
调用：
|
||
{{- include "common.compatibility.isOpenshift" . -}}
|
||
*/}}
|
||
{{- define "common.compatibility.isOpenshift" -}}
|
||
{{- if .Capabilities.APIVersions.Has "security.openshift.io/v1" -}}
|
||
{{- true -}}
|
||
{{- end -}}
|
||
{{- end -}}
|
||
|
||
{{/*
|
||
根据平台渲染一个兼容的 securityContext。
|
||
在默认情况下，它会保持原样。在其他平台（如 OpenShift）上，我们会移除那些在开箱即用的 restricted-v1 安全上下文约束（SCC）下无法正常工作的默认用户/组值。
|
||
调用：
|
||
{{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) -}}
|
||
*/}}
|
||
{{- define "common.compatibility.renderSecurityContext" -}}
|
||
{{- $adaptedContext := .secContext -}}
|
||
|
||
{{- if (((.context.Values.global).compatibility).openshift) -}}
|
||
{{- if or (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "force") (and (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "auto") (include "common.compatibility.isOpenshift" .context)) -}}
|
||
{{/* Remove incompatible user/group values that do not work in Openshift out of the box */}}
|
||
{{- $adaptedContext = omit $adaptedContext "fsGroup" "runAsUser" "runAsGroup" -}}
|
||
{{- if not .secContext.seLinuxOptions -}}
|
||
{{/* If it is an empty object, we remove it from the resulting context because it causes validation issues */}}
|
||
{{- $adaptedContext = omit $adaptedContext "seLinuxOptions" -}}
|
||
{{- end -}}
|
||
{{- end -}}
|
||
{{- end -}}
|
||
{{/* Remove empty seLinuxOptions object if global.compatibility.omitEmptySeLinuxOptions is set to true */}}
|
||
{{- if and (((.context.Values.global).compatibility).omitEmptySeLinuxOptions) (not .secContext.seLinuxOptions) -}}
|
||
{{- $adaptedContext = omit $adaptedContext "seLinuxOptions" -}}
|
||
{{- end -}}
|
||
{{/* Remove fields that are disregarded when running the container in privileged mode */}}
|
||
{{- if $adaptedContext.privileged -}}
|
||
{{- $adaptedContext = omit $adaptedContext "capabilities" -}}
|
||
{{- end -}}
|
||
{{- omit $adaptedContext "enabled" | toYaml -}}
|
||
{{- end -}}
|