Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[jfrog-platform] Added podSecurityContext and containerSecurityContext for pre-upgrade-check migration hook container #1929

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

mrarends
Copy link

PR Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

  • Chart Version bumped
  • CHANGELOG.md updated
  • Variables and other changes are documented in the README.md
  • Title of the PR starts with chart name (e.g. [artifactory])

What this PR does / why we need it:
The new pre-upgrade-check pod and container is missing the option to set security context settings. On clusters that require more strict settings the pre-upgrade-check can not be started:

violates PodSecurity'

	(combined from similar events): Error creating: pods "jfrog-platform-pre-upgrade-check-j527c" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "pre-upgrade-check" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "pre-upgrade-check" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "pre-upgrade-check" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "pre-upgrade-check" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

Special notes for your reviewer:

@oumkale oumkale self-requested a review October 15, 2024 05:52
@@ -103,6 +103,10 @@ rabbitmq:
image:
repository: bitnami/rabbitmq
tag: 3.12.10-debian-11-r1
podSecurityContext:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems like these changes are specific to you; we are ignoring them

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had to add this because otherwise 'helm lint' gives errors about unknown variables.

@@ -242,6 +246,11 @@ artifactory:
url: '{{ include "database.url" . }}'
user: artifactory
password: artifactory
ingress:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems like these changes are specific to you; we are ignoring them

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had to add this because otherwise 'helm lint' gives errors about unknown variables.

@oumkale
Copy link
Member

oumkale commented Oct 17, 2024

HI @mrarends,

Thank you so much for your efforts 🥳🥳. We will review this internally and update you once the release is out.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants