)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":28701,"name":"Dustin Specker","email":"v-dspecker@microsoft.com","username":"dustinspecker"},"change_message_id":"e489bce5448ff250c4c671605cb1326974039aa5","unresolved":false,"context_lines":[{"line_number":7,"context_line":"HTK: Refactor kubernetes security_context macro to allow scoping"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This PS updates the kubernetes_pod_security_context snippet"},{"line_number":10,"context_line":"to allow scoping to a container within a pod, in the process renaming"},{"line_number":11,"context_line":"the function to kubernetes_security_context to better match the intent."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: I8b9c7b72f836efaf6c9dc3ad20fd8462b0d06d77"},{"line_number":14,"context_line":"Signed-off-by: Pete Birley \u003cpete@port.direct\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":12,"id":"9fdfeff1_ff8d3d35","line":11,"range":{"start_line":10,"start_character":45,"end_line":11,"end_character":71},"updated":"2019-02-21 18:56:51.000000000","message":"I don\u0027t think this is true anymore.","commit_id":"73dc505ae0c191c128a1adbf5d2190cc32c1acc0"}],"helm-toolkit/templates/snippets/_kubernetes_container_security_context.tpl":[{"author":{"_account_id":28701,"name":"Dustin Specker","email":"v-dspecker@microsoft.com","username":"dustinspecker"},"change_message_id":"e489bce5448ff250c4c671605cb1326974039aa5","unresolved":false,"context_lines":[{"line_number":38,"context_line":"{{- define \"helm-toolkit.snippets.kubernetes_container_security_context\" -}}"},{"line_number":39,"context_line":"{{- $envAll :\u003d index . \"envAll\" -}}"},{"line_number":40,"context_line":"{{- $application :\u003d index . \"application\" -}}"},{"line_number":41,"context_line":"{{- $container :\u003d index . \"container\" | default false -}}"},{"line_number":42,"context_line":"{{- if hasKey $envAll.Values.pod \"security_context\" }}"},{"line_number":43,"context_line":"{{- if hasKey ( index $envAll.Values.pod.security_context ) $application }}"},{"line_number":44,"context_line":"{{- if hasKey ( index $envAll.Values.pod.security_context $application \"container\" ) $container }}"}],"source_content_type":"text/x-smarty","patch_set":12,"id":"9fdfeff1_1fa9218f","line":41,"range":{"start_line":41,"start_character":40,"end_line":41,"end_character":53},"updated":"2019-02-21 18:56:51.000000000","message":"I don\u0027t understand what this is needed for.\n\nWouldn\u0027t you always want a container name passed?","commit_id":"73dc505ae0c191c128a1adbf5d2190cc32c1acc0"},{"author":{"_account_id":28701,"name":"Dustin Specker","email":"v-dspecker@microsoft.com","username":"dustinspecker"},"change_message_id":"c7a23c90bacdfc2036cb5e8fcbee81adc4770a16","unresolved":false,"context_lines":[{"line_number":38,"context_line":"{{- define \"helm-toolkit.snippets.kubernetes_container_security_context\" -}}"},{"line_number":39,"context_line":"{{- $envAll :\u003d index . \"envAll\" -}}"},{"line_number":40,"context_line":"{{- $application :\u003d index . \"application\" -}}"},{"line_number":41,"context_line":"{{- $container :\u003d index . \"container\" | default false -}}"},{"line_number":42,"context_line":"{{- if hasKey $envAll.Values.pod \"security_context\" }}"},{"line_number":43,"context_line":"{{- if hasKey ( index $envAll.Values.pod.security_context ) $application }}"},{"line_number":44,"context_line":"{{- if hasKey ( index $envAll.Values.pod.security_context $application \"container\" ) $container }}"}],"source_content_type":"text/x-smarty","patch_set":14,"id":"5fc1f717_81642abb","line":41,"range":{"start_line":41,"start_character":0,"end_line":41,"end_character":57},"updated":"2019-03-05 20:31:41.000000000","message":"question: Why does this default to false? I don\u0027t understand the use case of not specifying a container name.","commit_id":"621e5851383e5bae29d5a64bc050ba5c2856cd45"},{"author":{"_account_id":17068,"name":"Jean-Philippe Evrard","email":"openstack@a.spamming.party","username":"evrardjp"},"change_message_id":"504132c22e947d9026704353ad2c952b03e98c63","unresolved":false,"context_lines":[{"line_number":35,"context_line":"        runAsUser: 34356"},{"line_number":36,"context_line":"*/}}"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"{{- define \"helm-toolkit.snippets.kubernetes_container_security_context\" -}}"},{"line_number":39,"context_line":"{{- $envAll :\u003d index . \"envAll\" -}}"},{"line_number":40,"context_line":"{{- $application :\u003d index . \"application\" -}}"},{"line_number":41,"context_line":"{{- $container :\u003d index . \"container\" | default false -}}"},{"line_number":42,"context_line":"{{- if hasKey $envAll.Values.pod \"security_context\" }}"},{"line_number":43,"context_line":"{{- if hasKey ( index $envAll.Values.pod.security_context ) $application }}"},{"line_number":44,"context_line":"{{- if hasKey ( index $envAll.Values.pod.security_context $application \"container\" ) $container }}"},{"line_number":45,"context_line":"securityContext:"},{"line_number":46,"context_line":"{{ toYaml ( index $envAll.Values.pod.security_context $application \"container\" $container ) | indent 2 }}"},{"line_number":47,"context_line":"{{- end -}}"},{"line_number":48,"context_line":"{{- end -}}"},{"line_number":49,"context_line":"{{- end -}}"},{"line_number":50,"context_line":"{{- end -}}"}],"source_content_type":"text/x-smarty","patch_set":14,"id":"9fdfeff1_0611f904","line":50,"range":{"start_line":38,"start_character":0,"end_line":50,"end_character":11},"updated":"2019-03-05 15:02:54.000000000","message":"nit: Wouldn\u0027t it be easier to indent properly, and mess with the indentation using indent/dindent?\n\nHere it\u0027s easy to forget an end.","commit_id":"621e5851383e5bae29d5a64bc050ba5c2856cd45"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"2f58f02d79f7cc84f5e20ca7931ac51c6e7c0cf4","unresolved":false,"context_lines":[{"line_number":35,"context_line":"        runAsUser: 34356"},{"line_number":36,"context_line":"*/}}"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"{{- define \"helm-toolkit.snippets.kubernetes_container_security_context\" -}}"},{"line_number":39,"context_line":"{{- $envAll :\u003d index . \"envAll\" -}}"},{"line_number":40,"context_line":"{{- $application :\u003d index . \"application\" -}}"},{"line_number":41,"context_line":"{{- $container :\u003d index . \"container\" | default false -}}"},{"line_number":42,"context_line":"{{- if hasKey $envAll.Values.pod \"security_context\" }}"},{"line_number":43,"context_line":"{{- if hasKey ( index $envAll.Values.pod.security_context ) $application }}"},{"line_number":44,"context_line":"{{- if hasKey ( index $envAll.Values.pod.security_context $application \"container\" ) $container }}"},{"line_number":45,"context_line":"securityContext:"},{"line_number":46,"context_line":"{{ toYaml ( index $envAll.Values.pod.security_context $application \"container\" $container ) | indent 2 }}"},{"line_number":47,"context_line":"{{- end -}}"},{"line_number":48,"context_line":"{{- end -}}"},{"line_number":49,"context_line":"{{- end -}}"},{"line_number":50,"context_line":"{{- end -}}"}],"source_content_type":"text/x-smarty","patch_set":14,"id":"5fc1f717_76e1c6d0","line":50,"range":{"start_line":38,"start_character":0,"end_line":50,"end_character":11},"in_reply_to":"9fdfeff1_0611f904","updated":"2019-03-05 19:52:18.000000000","message":"not quite sure I follow - the ends here are closing the define and conditionals above?","commit_id":"621e5851383e5bae29d5a64bc050ba5c2856cd45"}],"helm-toolkit/templates/snippets/_kubernetes_pod_security_context.tpl":[{"author":{"_account_id":17068,"name":"Jean-Philippe Evrard","email":"openstack@a.spamming.party","username":"evrardjp"},"change_message_id":"dca1fa2a85a7c5483af0c4302293ea619fbbe4d7","unresolved":false,"context_lines":[{"line_number":17,"context_line":"{{/*"},{"line_number":18,"context_line":"abstract: |"},{"line_number":19,"context_line":"  Renders securityContext for a Kubernetes pod."},{"line_number":20,"context_line":"  For pod level, seurity context see here: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.13/#podsecuritycontext-v1-core"},{"line_number":21,"context_line":"examples:"},{"line_number":22,"context_line":"  - values: |"},{"line_number":23,"context_line":"      pod:"}],"source_content_type":"text/x-smarty","patch_set":14,"id":"9fdfeff1_4662a1af","line":20,"range":{"start_line":20,"start_character":17,"end_line":20,"end_character":24},"updated":"2019-03-05 15:01:30.000000000","message":"nit: security","commit_id":"621e5851383e5bae29d5a64bc050ba5c2856cd45"}],"helm-toolkit/templates/snippets/_kubernetes_security_context.tpl":[{"author":{"_account_id":28025,"name":"Randeep Jalli","email":"rj2083@att.com","username":"randeep.jalli"},"change_message_id":"4304031945df07755a4c3bedabe0d644ef8a101d","unresolved":false,"context_lines":[{"line_number":29,"context_line":"        security_context:"},{"line_number":30,"context_line":"          myApp:"},{"line_number":31,"context_line":"            pod:"},{"line_number":32,"context_line":"              runAsNonRoot: true"},{"line_number":33,"context_line":"    usage: |"},{"line_number":34,"context_line":"      {{ dict \"envAll\" . \"application\" \"myApp\" | include \"helm-toolkit.snippets.kubernetes_security_context\" }}"},{"line_number":35,"context_line":"    return: |"}],"source_content_type":"text/x-smarty","patch_set":9,"id":"9fdfeff1_de6689ef","line":32,"updated":"2019-02-18 18:18:40.000000000","message":"Is there  a way to toggle runAsNonRoot by container or would this only allow it to be set at a pod level? I.e there may be some parts of an app that are in a container that need to be run as root and some that run in different containers that can run as non-root....","commit_id":"2854b3585d39aea19b6d486ec9abb8c8f914e3bd"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"d6912d4a8c0007a8b6f59784efc8437fa017e84e","unresolved":false,"context_lines":[{"line_number":29,"context_line":"        security_context:"},{"line_number":30,"context_line":"          myApp:"},{"line_number":31,"context_line":"            pod:"},{"line_number":32,"context_line":"              runAsNonRoot: true"},{"line_number":33,"context_line":"    usage: |"},{"line_number":34,"context_line":"      {{ dict \"envAll\" . \"application\" \"myApp\" | include \"helm-toolkit.snippets.kubernetes_security_context\" }}"},{"line_number":35,"context_line":"    return: |"}],"source_content_type":"text/x-smarty","patch_set":9,"id":"9fdfeff1_e40ae025","line":32,"in_reply_to":"9fdfeff1_de6689ef","updated":"2019-02-18 21:07:23.000000000","message":"see line 44 for an example of what you are asking for.","commit_id":"2854b3585d39aea19b6d486ec9abb8c8f914e3bd"},{"author":{"_account_id":7769,"name":"Pentheus","display_name":"Alan Meadows","email":"alan.meadows@gmail.com","username":"alanmeadows"},"change_message_id":"cf2cb2f1690550fa1d53978c992ef7fc21eb29b4","unresolved":false,"context_lines":[{"line_number":82,"context_line":"{{ toYaml ( index $envAll.Values.pod.security_context $application \"container\" $container ) | indent 2 }}"},{"line_number":83,"context_line":"{{- end -}}"},{"line_number":84,"context_line":"{{- else }}"},{"line_number":85,"context_line":"{{ toYaml ( index $envAll.Values.pod.security_context $application \"pod\" ) | indent 2 }}"},{"line_number":86,"context_line":"{{- end -}}"},{"line_number":87,"context_line":"{{- end -}}"},{"line_number":88,"context_line":"{{- end -}}"}],"source_content_type":"text/x-smarty","patch_set":9,"id":"9fdfeff1_8614534e","line":85,"updated":"2019-02-16 23:11:00.000000000","message":"I can only imagine this is for backwards compat, however it would make more sense to either ask for a pod based context:\n\n{{ dict \"envAll\" $envAll \"application\" \"keystone\" \"pod\" | include \"helm-toolkit.snippets.kubernetes_security_context\" | indent 6 }}\n\nor a container one:\n\n{{ dict \"envAll\" $envAll \"application\" \"keystone\" \"container\" \"keystone_api\" | include \"helm-toolkit.snippets.kubernetes_security_context\" | indent 10 }}\n\nDefaulting silently without a magic tuple string argument of \"container\" is not entirely intuitive at least to me.  Better yet entirely separate functions would not be completely without reason here.","commit_id":"2854b3585d39aea19b6d486ec9abb8c8f914e3bd"}]}