fix: qbittorrent container permission (#58)

* fix: qbittorrent container permissions * chore(deps): bump hyperglass to 0.4.3 --------- Signed-off-by: Ludovic Ortega <[email protected]>
M0NsTeRRR · Jun 17, 2024 · 1d80bca · 1d80bca
1 parent 96f5530
commit 1d80bca
Show file tree

Hide file tree

Showing 5 changed files with 31 additions and 17 deletions.
diff --git a/charts/hyperglass/Chart.yaml b/charts/hyperglass/Chart.yaml
@@ -3,9 +3,9 @@ kubeVersion: ">=1.23.0-0"
 name: hyperglass
 description: hyperglass helm chart for Kubernetes
 type: application
-version: 0.1.3
+version: 0.1.4
 # image: ghcr.io/m0nsterrr/hyperglass
-appVersion: "v2.0.2"
+appVersion: "v2.0.3"
 maintainers:
   - name: Ludovic Ortega
     email: [email protected]

diff --git a/charts/hyperglass/README.md b/charts/hyperglass/README.md
@@ -1,6 +1,6 @@
 # hyperglass
 
-![Version: 0.1.3](https://img.shields.io/badge/Version-0.1.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v2.0.2](https://img.shields.io/badge/AppVersion-v2.0.2-informational?style=flat-square)
+![Version: 0.1.4](https://img.shields.io/badge/Version-0.1.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v2.0.3](https://img.shields.io/badge/AppVersion-v2.0.3-informational?style=flat-square)
 
 hyperglass helm chart for Kubernetes
 

diff --git a/charts/qbittorrent/Chart.yaml b/charts/qbittorrent/Chart.yaml
@@ -3,7 +3,7 @@ kubeVersion: ">=1.23.0-0"
 name: qbittorrent
 description: qbittorrent helm chart for Kubernetes
 type: application
-version: 0.4.2
+version: 0.4.3
 # image: ghcr.io/onedr0p/qbittorrent
 appVersion: "4.6.5"
 maintainers:

diff --git a/charts/qbittorrent/README.md b/charts/qbittorrent/README.md
@@ -1,6 +1,6 @@
 # qbittorrent
 
-![Version: 0.4.2](https://img.shields.io/badge/Version-0.4.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 4.6.5](https://img.shields.io/badge/AppVersion-4.6.5-informational?style=flat-square)
+![Version: 0.4.3](https://img.shields.io/badge/Version-0.4.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 4.6.5](https://img.shields.io/badge/AppVersion-4.6.5-informational?style=flat-square)
 
 qbittorrent helm chart for Kubernetes
 
@@ -74,10 +74,18 @@ helm repo add adminafk https://helm-charts.adminafk.fr
 | nodeSelector | object | `{}` |  |
 | podAnnotations | object | `{}` |  |
 | podLabels | object | `{}` |  |
-| podSecurityContext | object | `{}` |  |
+| podSecurityContext.fsGroup | int | `65534` |  |
+| podSecurityContext.fsGroupChangePolicy | string | `"OnRootMismatch"` |  |
 | replicaCount | int | `1` |  |
 | resources | object | `{}` |  |
-| securityContext | object | `{}` |  |
+| securityContext.allowPrivilegeEscalation | bool | `false` |  |
+| securityContext.capabilities.drop[0] | string | `"ALL"` |  |
+| securityContext.privileged | bool | `false` |  |
+| securityContext.readOnlyRootFilesystem | bool | `true` |  |
+| securityContext.runAsGroup | int | `65534` |  |
+| securityContext.runAsNonRoot | bool | `true` |  |
+| securityContext.runAsUser | int | `65534` |  |
+| securityContext.seccompProfile.type | string | `"RuntimeDefault"` |  |
 | service.torrent.annotations | object | `{}` | Annotations to add to the torrent service |
 | service.torrent.port | int | `8388` |  |
 | service.torrent.type | string | `"ClusterIP"` |  |

diff --git a/charts/qbittorrent/values.yaml b/charts/qbittorrent/values.yaml
@@ -35,16 +35,22 @@ serviceAccount:
 podAnnotations: {}
 podLabels: {}
 
-podSecurityContext: {}
-  # fsGroup: 2000
-
-securityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
-  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  # runAsUser: 1000
+podSecurityContext:
+  fsGroup: 65534
+  fsGroupChangePolicy: OnRootMismatch
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  privileged: false
+  runAsUser: 65534
+  runAsGroup: 65534
+  seccompProfile:
+    type: RuntimeDefault
 
 service:
   web: