Added configurations for OpenShift 4.11

Signed-off-by: Andrew Block <andy.block@gmail.com>

README.md

@@ -138,12 +138,14 @@ Additional parameters can be specified if desired. Consult the chart [values](ch
 
 ### Installing the Helm Chart
 
-Install the chart using the name of the plugin as the Helm release name into a new namespace or an existing namespace as specified by the `my-plugin-namespace` parameter by using the following command:
+Install the chart using the name of the plugin as the Helm release name into a new namespace or an existing namespace as specified by the `my-plugin-namespace` parameter and providing the location of the image within the `plugin.image` parameter by using the following command:
 
 ```shell
-helm upgrade -i  my-plugin charts/openshift-console-plugin -n my-plugin-namespace --create-namespace
+helm upgrade -i  my-plugin charts/openshift-console-plugin -n my-plugin-namespace --create-namespace --set plugin.image=my-plugin-image-location
 ```
 
+NOTE: When deploying on OpenShift 4.10, it is recommended to add the parameter `--set plugin.securityContext.enabled=false` which will omit configurations related to Pod Security.
+
 ## Linting
 
 This project adds prettier, eslint, and stylelint. Linting can be run with

charts/openshift-console-plugin/templates/deployment.yaml

@@ -23,9 +23,8 @@ spec:
             - containerPort: {{ .Values.plugin.port }}
               protocol: TCP
           imagePullPolicy: {{ .Values.plugin.imagePullPolicy }}
-          {{- if .Values.plugin.containerSecurityContext }}
-          securityContext:
-            {{ tpl (toYaml .Values.plugin.containerSecurityContext | indent 12) . }}
+          {{- if and (.Values.plugin.securityContext.enabled) (.Values.plugin.containerSecurityContext) }}
+          securityContext: {{ tpl (toYaml (omit .Values.plugin.containerSecurityContext "enabled")) $ | nindent 12 }}
           {{- end }}
           resources:
             {{- toYaml .Values.plugin.resources | nindent 12 }}
@@ -48,9 +47,8 @@ spec:
             defaultMode: 420
       restartPolicy: Always
       dnsPolicy: ClusterFirst
-      {{- if .Values.plugin.podSecurityContext }}
-      securityContext:
-        {{ tpl (toYaml .Values.plugin.podSecurityContext | indent 8) . }}
+      {{- if and (.Values.plugin.securityContext.enabled) (.Values.plugin.podSecurityContext) }}
+      securityContext: {{ tpl (toYaml (omit .Values.plugin.podSecurityContext "enabled")) $ | nindent 8 }}
       {{- end }}
   strategy:
     type: RollingUpdate

charts/openshift-console-plugin/templates/patch-consoles-job.yaml

@@ -18,18 +18,16 @@ spec:
     spec:
       restartPolicy: OnFailure
       serviceAccountName: {{ template "openshift-console-plugin.patcherServiceAccountName" . }}
-      {{- if .Values.plugin.jobs.patchConsoles.podSecurityContext }}
-      securityContext:
-        {{ tpl (toYaml .Values.plugin.jobs.patchConsoles.podSecurityContext | indent 8) . }}
+      {{- if  and (.Values.plugin.securityContext.enabled) (.Values.plugin.jobs.patchConsoles.podSecurityContext.enabled) }}
+      securityContext: {{ tpl (toYaml (omit .Values.plugin.jobs.patchConsoles.podSecurityContext "enabled")) $ | nindent 8 }}
       {{- end }}
       terminationGracePeriodSeconds: 400
       dnsPolicy: ClusterFirst
       containers:
         - name: {{ template "openshift-console-plugin.patcherName" . }}
           image: {{ required "Patcher image must be specified!" .Values.plugin.jobs.patchConsoles.image }}
-          {{- if .Values.plugin.jobs.patchConsoles.containerSecurityContext }}
-          securityContext:
-            {{ tpl (toYaml .Values.plugin.jobs.patchConsoles.containerSecurityContext | indent 8) . }}
+          {{- if  and (.Values.plugin.disableSecurityContext) (.Values.plugin.jobs.patchConsoles.containerSecurityContext.enabled) }}
+          securityContext: {{ tpl (toYaml (omit .Values.plugin.jobs.patchConsoles.containerSecurityContext "enabled")) $ | nindent 12 }}
           {{- end }}
           resources:
             {{- toYaml .Values.plugin.jobs.patchConsoles.resources | nindent 12 }}
@@ -37,5 +35,8 @@ spec:
             - /bin/bash
             - -c
             - |
-                oc patch consoles.operator.openshift.io cluster --patch '{ "spec": { "plugins": ["{{ template "openshift-console-plugin.name" . }}"] } }' --type=merge
+                existingPlugins=$(oc get consoles.operator.openshift.io cluster -o json | jq -c '.spec.plugins // []')
+                mergedPlugins=$(jq --argjson existingPlugins "${existingPlugins}" --argjson consolePlugin '["{{ template "openshift-console-plugin.name" . }}"]' -c  -n '$existingPlugins + $consolePlugin | unique')
+                patchedPlugins=$(jq --argjson mergedPlugins $mergedPlugins -n -c  '{ "spec": { "plugins": $mergedPlugins } }')
+                oc patch consoles.operator.openshift.io cluster --patch $patchedPlugins  --type=merge
 {{- end }}

charts/openshift-console-plugin/values.yaml

@@ -6,8 +6,19 @@ plugin:
   imagePullPolicy: IfNotPresent
   replicas: 2
   port: 9443
-  podSecurityContext: {}
-  containerSecurityContext: {}
+  securityContext:
+    enabled: true
+  podSecurityContext:
+    enabled: true
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+  containerSecurityContext:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
   resources:
     requests:
       cpu: 10m
@@ -26,8 +37,17 @@ plugin:
     patchConsoles:
       enabled: true
       image: "registry.redhat.io/openshift4/ose-tools-rhel8@sha256:e44074f21e0cca6464e50cb6ff934747e0bd11162ea01d522433a1a1ae116103"
-      podSecurityContext: {}
-      containerSecurityContext: {}
+      podSecurityContext:
+        enabled: true
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containerSecurityContext:
+        enabled: true
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
       resources:
         requests:
           cpu: 10m