diff --git a/library/common/1.0.0/templates/lib/container/_securityContext.tpl b/library/common/1.0.0/templates/lib/container/_securityContext.tpl index ceeb08cd..e4ac3e16 100644 --- a/library/common/1.0.0/templates/lib/container/_securityContext.tpl +++ b/library/common/1.0.0/templates/lib/container/_securityContext.tpl @@ -19,24 +19,28 @@ readOnlyRootFilesystem: {{ $secContext.readOnlyRootFilesystem }} allowPrivilegeEscalation: {{ $secContext.allowPrivilegeEscalation }} privileged: {{ $secContext.privileged }} capabilities: -{{- if or $secContext.capabilities.add $secContext.capabilities.drop }} - {{- if or (not (kindIs "slice" $secContext.capabilities.add)) (not (kindIs "slice" $secContext.capabilities.drop)) }} - {{- fail "Either or capabilities is not a list."}} - {{- end }} - {{- with $secContext.capabilities.add }} - add: - {{- range . }} - - {{ tpl . $ | quote }} + {{- if or $secContext.capabilities.add $secContext.capabilities.drop }} + {{- if or (not (kindIs "slice" $secContext.capabilities.add)) (not (kindIs "slice" $secContext.capabilities.drop)) }} + {{- fail "Either or capabilities is not a list."}} {{- end }} - {{- end }} - {{- with $secContext.capabilities.drop }} - drop: - {{- range . }} - - {{ tpl . $ | quote }} + {{- with $secContext.capabilities.add }} + add: + {{- range . }} + - {{ tpl . $ | quote }} + {{- end }} {{- end }} + {{- with $secContext.capabilities.drop }} + drop: + {{- range . }} + - {{ tpl . $ | quote }} + {{- end }} + {{- end }} + {{- else }} + add: [] + drop: [] {{- end }} -{{- else }} - add: [] - drop: [] -{{- end }} +{{- end -}} + + +{{- define "ix.v1.common.container.podSecurityContext" -}} {{- end -}}