From 8e3eb7f13dd974f1625ce45f914e067585e5f42b Mon Sep 17 00:00:00 2001 From: Johannes Edmeier Date: Fri, 6 Dec 2024 14:51:30 +0100 Subject: [PATCH] refa: avoid hard-coded uid in helm chart In order to improve installation on openshift, we need to avoid the hard-coded uid/gid in the helm chart --- .../steadybit-extension-prometheus/Chart.yaml | 2 +- .../templates/deployment.yaml | 11 +--- .../__snapshot__/deployment_test.yaml.snap | 62 +++++++++++-------- .../values.yaml | 13 +++- 4 files changed, 51 insertions(+), 37 deletions(-) diff --git a/charts/steadybit-extension-prometheus/Chart.yaml b/charts/steadybit-extension-prometheus/Chart.yaml index 3e6f16a..5f9cdea 100644 --- a/charts/steadybit-extension-prometheus/Chart.yaml +++ b/charts/steadybit-extension-prometheus/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: steadybit-extension-prometheus description: Steadybit Prometheus extension Helm chart for Kubernetes. -version: 1.5.9 +version: 1.5.10 appVersion: v2.1.2 home: https://www.steadybit.com/ icon: https://steadybit-website-assets.s3.amazonaws.com/logo-symbol-transparent.png diff --git a/charts/steadybit-extension-prometheus/templates/deployment.yaml b/charts/steadybit-extension-prometheus/templates/deployment.yaml index 88b8da4..24b3b2e 100644 --- a/charts/steadybit-extension-prometheus/templates/deployment.yaml +++ b/charts/steadybit-extension-prometheus/templates/deployment.yaml @@ -103,15 +103,10 @@ spec: httpGet: path: /health/readiness port: 8088 + {{- with .Values.containerSecurityContext }} securityContext: - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 10000 - runAsGroup: 10000 - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL + {{- toYaml . | nindent 12 }} + {{- end }} volumes: {{- include "extensionlib.deployment.volumes" (list .) | nindent 8 }} serviceAccountName: {{ .Values.serviceAccount.name }} diff --git a/charts/steadybit-extension-prometheus/tests/__snapshot__/deployment_test.yaml.snap b/charts/steadybit-extension-prometheus/tests/__snapshot__/deployment_test.yaml.snap index f30d8c5..74cbe95 100644 --- a/charts/steadybit-extension-prometheus/tests/__snapshot__/deployment_test.yaml.snap +++ b/charts/steadybit-extension-prometheus/tests/__snapshot__/deployment_test.yaml.snap @@ -70,10 +70,11 @@ manifest should match snapshot using podAnnotations and Labels: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-prometheus volumes: null manifest should match snapshot with TLS: @@ -150,13 +151,14 @@ manifest should match snapshot with TLS: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: - mountPath: /etc/extension/certificates/server-cert name: certificate-server-cert readOnly: true + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-prometheus volumes: - name: certificate-server-cert @@ -240,10 +242,11 @@ manifest should match snapshot with extra env vars: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-prometheus volumes: null manifest should match snapshot with extra labels: @@ -318,10 +321,11 @@ manifest should match snapshot with extra labels: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-prometheus volumes: null manifest should match snapshot with mutual TLS: @@ -400,9 +404,6 @@ manifest should match snapshot with mutual TLS: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: - mountPath: /etc/extension/certificates/client-cert-a name: certificate-client-cert-a @@ -410,6 +411,10 @@ manifest should match snapshot with mutual TLS: - mountPath: /etc/extension/certificates/server-cert name: certificate-server-cert readOnly: true + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-prometheus volumes: - name: certificate-client-cert-a @@ -496,10 +501,11 @@ manifest should match snapshot with mutual TLS using containerPaths: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-prometheus volumes: null manifest should match snapshot with podSecurityContext: @@ -572,12 +578,12 @@ manifest should match snapshot with podSecurityContext: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null securityContext: + runAsNonRoot: true runAsUser: 2222 + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-prometheus volumes: null manifest should match snapshot with priority class: @@ -650,11 +656,12 @@ manifest should match snapshot with priority class: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null priorityClassName: my-priority-class + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-prometheus volumes: null manifest should match snapshot without TLS: @@ -727,9 +734,10 @@ manifest should match snapshot without TLS: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: null + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-prometheus volumes: null diff --git a/charts/steadybit-extension-prometheus/values.yaml b/charts/steadybit-extension-prometheus/values.yaml index c248d08..84c50da 100644 --- a/charts/steadybit-extension-prometheus/values.yaml +++ b/charts/steadybit-extension-prometheus/values.yaml @@ -105,7 +105,18 @@ affinity: {} priorityClassName: null # podSecurityContext -- SecurityContext to apply to the pod. -podSecurityContext: {} +podSecurityContext: + seccompProfile: + type: RuntimeDefault + runAsNonRoot: true + +# containerSecurityContext -- SecurityContext to apply to the container. +containerSecurityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL # extraEnv -- Array with extra environment variables to add to the container # e.g: