feat(infrastructure): automatic deploy

7project/charts/myapp-chart/templates/app-deployment.yaml

@@ -13,10 +13,18 @@ spec:
       labels:
         app: {{ .Values.app.name }}
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: {{ .Values.app.name }}
           image: "{{- if .Values.image.digest -}}{{ .Values.image.repository }}@{{ .Values.image.digest }}{{- else -}}{{ .Values.image.repository }}:{{ default "latest" .Values.image.tag }}{{- end -}}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
           ports:
             - containerPort: {{ .Values.app.port }}
           env:

7project/charts/myapp-chart/templates/rabbitmq-queue.yaml

@@ -2,7 +2,7 @@
 apiVersion: rabbitmq.com/v1beta1
 kind: Queue
 metadata:
-  name: {{ .Values.worker.mailQueueName }}
+  name: {{ .Values.worker.mailQueueName | replace "_" "-" | lower }}
   namespace: {{ .Values.rabbitmq.namespace | default "rabbitmq" }}
   labels:
     app.kubernetes.io/managed-by: Helm

7project/charts/myapp-chart/templates/worker-deployment.yaml

@@ -13,10 +13,18 @@ spec:
       labels:
         app: {{ printf "%s-worker" .Values.app.name }}
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: {{ printf "%s-worker" .Values.app.name }}
           image: "{{- if .Values.image.digest -}}{{ .Values.image.repository }}@{{ .Values.image.digest }}{{- else -}}{{ .Values.image.repository }}:{{ default "latest" .Values.image.tag }}{{- end -}}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
           command:
             - celery
             - -A