diff --git a/jsonnet/kube-prometheus/kube-rbac-proxy/container.libsonnet b/jsonnet/kube-prometheus/kube-rbac-proxy/container.libsonnet index e1d3dc0e93cc6bcce9a178f1d194c51a5e1f296c..fa85f0cf6130141c037c0bb919f6418e69ed0dd6 100644 --- a/jsonnet/kube-prometheus/kube-rbac-proxy/container.libsonnet +++ b/jsonnet/kube-prometheus/kube-rbac-proxy/container.libsonnet @@ -1,8 +1,3 @@ -local k = import 'github.com/ksonnet/ksonnet-lib/ksonnet.beta.4/k.libsonnet'; -local deployment = k.apps.v1.deployment; -local container = deployment.mixin.spec.template.spec.containersType; -local containerPort = container.portsType; - { local krp = self, config+:: { @@ -33,17 +28,22 @@ local containerPort = container.portsType; spec+: { template+: { spec+: { - containers+: [ - container.new(krp.config.kubeRbacProxy.name, krp.config.kubeRbacProxy.image) + - container.mixin.securityContext.withRunAsUser(65534) + - container.withArgs([ + containers+: [{ + name: krp.config.kubeRbacProxy.name, + image: krp.config.kubeRbacProxy.image, + args: [ '--logtostderr', '--secure-listen-address=' + krp.config.kubeRbacProxy.secureListenAddress, '--tls-cipher-suites=' + std.join(',', krp.config.kubeRbacProxy.tlsCipherSuites), '--upstream=' + krp.config.kubeRbacProxy.upstream, - ]) + - container.withPorts(containerPort.newNamed(krp.config.kubeRbacProxy.securePort, krp.config.kubeRbacProxy.securePortName)), - ], + ], + ports: [ + { name: krp.config.kubeRbacProxy.securePortName, containerPort: krp.config.kubeRbacProxy.securePort }, + ], + securityContext: { + runAsUser: 65534, + }, + }], }, }, },