*: re-generate manifests

Documentation/user-guides/cluster-monitoring.md

@@ -68,6 +68,9 @@ spec:
           requests:
             cpu: 100m
             memory: 50Mi
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
       serviceAccountName: prometheus-operator
 ```
 
@@ -238,6 +241,9 @@ spec:
         app: kube-state-metrics
     spec:
       serviceAccountName: kube-state-metrics
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
       containers:
       - name: kube-rbac-proxy-main
         image: quay.io/brancz/kube-rbac-proxy:v0.2.0
@@ -298,9 +304,9 @@ spec:
           - /pod_nanny
           - --container=kube-state-metrics
           - --cpu=100m
-          - --extra-cpu=1m
-          - --memory=100Mi
-          - --extra-memory=2Mi
+          - --extra-cpu=2m
+          - --memory=150Mi
+          - --extra-memory=30Mi
           - --threshold=5
           - --deployment=kube-state-metrics
 ```
@@ -348,7 +354,7 @@ metadata:
     prometheus: k8s
 spec:
   replicas: 2
-  version: v2.0.0
+  version: v2.1.0
   serviceAccountName: prometheus-k8s
   serviceMonitorSelector:
     matchExpressions:

Documentation/user-guides/getting-started.md

@@ -113,6 +113,9 @@ spec:
           requests:
             cpu: 100m
             memory: 50Mi
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
       serviceAccountName: prometheus-operator
 ```
 

bundle.yaml

@@ -98,4 +98,7 @@ spec:
           requests:
             cpu: 100m
             memory: 50Mi
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
       serviceAccountName: prometheus-operator

contrib/kube-prometheus/manifests/prometheus-operator/prometheus-operator.yaml

@@ -27,4 +27,7 @@ spec:
           requests:
             cpu: 100m
             memory: 50Mi
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
       serviceAccountName: prometheus-operator

example/non-rbac/prometheus-operator.yaml

@@ -27,3 +27,6 @@ spec:
           requests:
             cpu: 100m
             memory: 50Mi
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534

example/rbac/prometheus-operator/prometheus-operator.yaml

@@ -23,11 +23,11 @@ spec:
         resources:
           limits:
             cpu: 200m
-            memory: 300Mi
+            memory: 100Mi
           requests:
             cpu: 100m
             memory: 50Mi
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
       serviceAccountName: prometheus-operator
-       securityContext:
-         runAsNonRoot: true
-         runAsUser: 65534

hack/generate/prometheus-operator.jsonnet

@@ -20,6 +20,8 @@ local operatorContainer =
   container.mixin.resources.limits({cpu: "200m", memory: "100Mi"});
 
 local operatorDeployment = deployment.new("prometheus-operator", 1, operatorContainer, podLabels) +
-  deployment.mixin.metadata.labels(podLabels);
+  deployment.mixin.metadata.labels(podLabels) +
+  deployment.mixin.spec.template.spec.securityContext.runAsNonRoot(true) +
+  deployment.mixin.spec.template.spec.securityContext.runAsUser(65534);
 
 operatorDeployment