fix uds socket (istio#12688)

* uds fix * readonly
xun1009 · Mar 22, 2019 · 8f42a40 · 8f42a40
1 parent ffba22a
commit 8f42a40
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 4 deletions.
diff --git a/install/kubernetes/helm/istio/charts/gateways/templates/deployment.yaml b/install/kubernetes/helm/istio/charts/gateways/templates/deployment.yaml
@@ -210,7 +210,8 @@ spec:
           volumeMounts:
           {{- if $.Values.global.sds.enabled }}
           - name: sdsudspath
-            mountPath: /var/run/sds
+            mountPath: /var/run/sds/uds_path
+            readOnly: true
           {{- if $.Values.global.sds.useTrustworthyJwt }}
           - name: istio-token
             mountPath: /var/run/secrets/tokens
@@ -243,7 +244,8 @@ spec:
       {{- if $.Values.global.sds.enabled }}
       - name: sdsudspath
         hostPath:
-          path: /var/run/sds
+          path: /var/run/sds/uds_path
+          type: Socket
       {{- if $.Values.global.sds.useTrustworthyJwt }}
       - name: istio-token
         projected:

diff --git a/install/kubernetes/helm/istio/templates/sidecar-injector-configmap.yaml b/install/kubernetes/helm/istio/templates/sidecar-injector-configmap.yaml
@@ -247,8 +247,9 @@ data:
           readOnly: true
         {{- end }}
         {{- if .Values.global.sds.enabled }}
-        - mountPath: /var/run/sds
+        - mountPath: /var/run/sds/uds_path
           name: sds-uds-path
+          readOnly: true
         {{- if .Values.global.sds.useTrustworthyJwt }}
         - mountPath: /var/run/secrets/tokens
           name: istio-token
@@ -277,7 +278,8 @@ data:
       {{- if .Values.global.sds.enabled }}
       - name: sds-uds-path
         hostPath:
-          path: /var/run/sds
+          path: /var/run/sds/uds_path
+          type: Socket
       {{- if .Values.global.sds.useTrustworthyJwt }}
       - name: istio-token
         projected: