Skip to content

Commit a9fbb23

Browse files
dhauglidhaugli
authored
Update security context (#134)
* Update security context * updated chart.yaml for all 4 charts * updated libchart * corrected chart version and added default resources * corrected chart version and added default resources
1 parent deb8298 commit a9fbb23

File tree

13 files changed

+109
-90
lines changed

13 files changed

+109
-90
lines changed

‎dotnet/Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
apiVersion: v2
22
description: .NET Core Helm Chart
33
name: dotnet
4-
version: 9.2.0
4+
version: 10.0.0
55
dependencies:
66
- name: libchart
7-
version: 0.3.0
7+
version: 1.0.0
88
repository: file://../libchart

‎dotnet/values.yaml

+17-14
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,17 @@ serviceAccount:
2929
podAnnotations: {}
3030
podLabels: {}
3131

32-
securityContext:
32+
podSecurityContext:
3333
runAsNonRoot: true
34-
# capabilities:
35-
# drop:
36-
# - ALL
37-
# readOnlyRootFilesystem: true
38-
# runAsUser: 1000
39-
# fsGroup: 2000
34+
runAsUser: 65534
35+
fsGroup: 65534
36+
37+
securityContext:
38+
readOnlyRootFilesystem: true
39+
allowPrivilegeEscalation: false
40+
capabilities:
41+
drop:
42+
- ALL
4043

4144
environment: {}
4245
secrets: {}
@@ -62,17 +65,17 @@ csi: {}
6265
# objectType: key
6366
# objectVersion: ""
6467

65-
resources: {}
68+
resources:
6669
# We usually recommend not to specify default resources and to leave this as a conscious
6770
# choice for the user. This also increases chances charts run on environments with little
6871
# resources, such as Minikube. If you do want to specify resources, uncomment the following
6972
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
70-
# limits:
71-
# cpu: 100m
72-
# memory: 128Mi
73-
# requests:
74-
# cpu: 100m
75-
# memory: 128Mi
73+
limits:
74+
cpu: 200m
75+
memory: 512Mi
76+
requests:
77+
cpu: 200m
78+
memory: 512Mi
7679

7780
nodeSelector: {}
7881

‎golang/Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
apiVersion: v2
22
description: golan Helm Chart
33
name: golang
4-
version: 13.2.0
4+
version: 14.0.0
55
dependencies:
66
- name: libchart
7-
version: 0.3.0
7+
version: 1.0.0
88
repository: file://../libchart

‎golang/values.yaml

+17-14
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,17 @@ serviceAccount:
2929
podAnnotations: {}
3030
podLabels: {}
3131

32-
securityContext:
32+
podSecurityContext:
3333
runAsNonRoot: true
34-
# capabilities:
35-
# drop:
36-
# - ALL
37-
# readOnlyRootFilesystem: true
38-
# runAsUser: 1000
39-
# fsGroup: 2000
34+
runAsUser: 65534
35+
fsGroup: 65534
36+
37+
securityContext:
38+
readOnlyRootFilesystem: true
39+
allowPrivilegeEscalation: false
40+
capabilities:
41+
drop:
42+
- ALL
4043

4144
environment: {}
4245
secrets: {}
@@ -62,17 +65,17 @@ csi: {}
6265
# objectType: key
6366
# objectVersion: ""
6467

65-
resources: {}
68+
resources:
6669
# We usually recommend not to specify default resources and to leave this as a conscious
6770
# choice for the user. This also increases chances charts run on environments with little
6871
# resources, such as Minikube. If you do want to specify resources, uncomment the following
6972
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
70-
# limits:
71-
# cpu: 100m
72-
# memory: 128Mi
73-
# requests:
74-
# cpu: 100m
75-
# memory: 128Mi
73+
limits:
74+
cpu: 100m
75+
memory: 256Mi
76+
requests:
77+
cpu: 100m
78+
memory: 256Mi
7679

7780
nodeSelector: {}
7881

‎java/Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
apiVersion: v2
22
description: Java Helm Chart
33
name: java
4-
version: 6.2.0
4+
version: 7.0.0
55
dependencies:
66
- name: libchart
7-
version: 0.3.0
7+
version: 1.0.0
88
repository: file://../libchart

‎java/values.yaml

+17-14
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,17 @@ serviceAccount:
2929
podAnnotations: {}
3030
podLabels: {}
3131

32-
securityContext:
32+
podSecurityContext:
3333
runAsNonRoot: true
34-
# capabilities:
35-
# drop:
36-
# - ALL
37-
# readOnlyRootFilesystem: true
38-
# runAsUser: 1000
39-
# fsGroup: 2000
34+
runAsUser: 65534
35+
fsGroup: 65534
36+
37+
securityContext:
38+
readOnlyRootFilesystem: true
39+
allowPrivilegeEscalation: false
40+
capabilities:
41+
drop:
42+
- ALL
4043

4144
environment: {}
4245
secrets: {}
@@ -62,17 +65,17 @@ csi: {}
6265
# objectType: key
6366
# objectVersion: ""
6467

65-
resources: {}
68+
resources:
6669
# We usually recommend not to specify default resources and to leave this as a conscious
6770
# choice for the user. This also increases chances charts run on environments with little
6871
# resources, such as Minikube. If you do want to specify resources, uncomment the following
6972
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
70-
# limits:
71-
# cpu: 100m
72-
# memory: 128Mi
73-
# requests:
74-
# cpu: 100m
75-
# memory: 128Mi
73+
limits:
74+
cpu: 200m
75+
memory: 512Mi
76+
requests:
77+
cpu: 200m
78+
memory: 512Mi
7679

7780
nodeSelector: {}
7881

‎libchart/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ type: library
1515
# This is the chart version. This version number should be incremented each time you make changes
1616
# to the chart and its templates, including the app version.
1717
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18-
version: 0.3.0
18+
version: 1.0.0
1919

2020
# This is the version number of the application being deployed. This version number should be
2121
# incremented each time you make changes to the application. Versions are not expected to

‎libchart/templates/_pod.tpl

+3-2
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ imagePullSecrets:
77
{{- end }}
88
serviceAccountName: {{ include "libchart.serviceAccountName" . }}
99
securityContext:
10-
{{- toYaml .Values.securityContext | nindent 2 }}
10+
{{- toYaml .Values.podSecurityContext | nindent 2 }}
1111
containers:
1212
- name: {{ .Chart.Name }}
1313
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -65,7 +65,8 @@ containers:
6565
{{- end }}
6666
resources:
6767
{{ toYaml .Values.resources | nindent 6 }}
68-
68+
securityContext:
69+
{{- toYaml .Values.securityContext | nindent 6 }}
6970
{{- with .Values.nodeSelector }}
7071
nodeSelector:
7172
{{ toYaml . | nindent 4 }}

‎libchart/values.yaml

+10-7
Original file line numberDiff line numberDiff line change
@@ -30,14 +30,17 @@ serviceAccount:
3030
podAnnotations: {}
3131
podLabels: {}
3232

33-
securityContext:
33+
podSecurityContext:
3434
runAsNonRoot: true
35-
# capabilities:
36-
# drop:
37-
# - ALL
38-
# readOnlyRootFilesystem: true
39-
# runAsUser: 1000
40-
# fsGroup: 2000
35+
runAsUser: 65534
36+
fsGroup: 65534
37+
38+
securityContext:
39+
readOnlyRootFilesystem: true
40+
allowPrivilegeEscalation: false
41+
capabilities:
42+
drop:
43+
- ALL
4144

4245
environment: {}
4346
secrets: {}

‎nodejs/Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
apiVersion: v2
22
description: Node.js Helm Chart
33
name: nodejs
4-
version: 13.2.0
4+
version: 14.0.0
55
dependencies:
66
- name: libchart
7-
version: 0.3.0
7+
version: 1.0.0
88
repository: file://../libchart

‎nodejs/values.yaml

+17-14
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,17 @@ serviceAccount:
2929
podAnnotations: {}
3030
podLabels: {}
3131

32-
securityContext:
32+
podSecurityContext:
3333
runAsNonRoot: true
34-
# capabilities:
35-
# drop:
36-
# - ALL
37-
# readOnlyRootFilesystem: true
38-
# runAsUser: 1000
39-
# fsGroup: 2000
34+
runAsUser: 65534
35+
fsGroup: 65534
36+
37+
securityContext:
38+
readOnlyRootFilesystem: true
39+
allowPrivilegeEscalation: false
40+
capabilities:
41+
drop:
42+
- ALL
4043

4144
environment: {}
4245
secrets: {}
@@ -62,17 +65,17 @@ csi: {}
6265
# objectType: key
6366
# objectVersion: ""
6467

65-
resources: {}
68+
resources:
6669
# We usually recommend not to specify default resources and to leave this as a conscious
6770
# choice for the user. This also increases chances charts run on environments with little
6871
# resources, such as Minikube. If you do want to specify resources, uncomment the following
6972
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
70-
# limits:
71-
# cpu: 100m
72-
# memory: 128Mi
73-
# requests:
74-
# cpu: 100m
75-
# memory: 128Mi
73+
limits:
74+
cpu: 200m
75+
memory: 512Mi
76+
requests:
77+
cpu: 200m
78+
memory: 512Mi
7679

7780
nodeSelector: {}
7881

‎web/Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ apiVersion: v2
22
appVersion: "1.0"
33
description: Helm chart for deployment of web servers
44
name: web
5-
version: 10.3.0
5+
version: 11.0.0
66
dependencies:
77
- name: libchart
8-
version: 0.3.0
8+
version: 1.0.0
99
repository: file://../libchart

‎web/values.yaml

+17-14
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,17 @@ serviceAccount:
2929
podAnnotations: {}
3030
podLabels: {}
3131

32-
securityContext:
32+
podSecurityContext:
3333
runAsNonRoot: true
34-
# capabilities:
35-
# drop:
36-
# - ALL
37-
# readOnlyRootFilesystem: true
38-
# runAsUser: 1000
39-
# fsGroup: 2000
34+
runAsUser: 65534
35+
fsGroup: 65534
36+
37+
securityContext:
38+
readOnlyRootFilesystem: true
39+
allowPrivilegeEscalation: false
40+
capabilities:
41+
drop:
42+
- ALL
4043

4144
environment: {}
4245
secrets: {}
@@ -62,17 +65,17 @@ csi: {}
6265
# objectType: key
6366
# objectVersion: ""
6467

65-
resources: {}
68+
resources:
6669
# We usually recommend not to specify default resources and to leave this as a conscious
6770
# choice for the user. This also increases chances charts run on environments with little
6871
# resources, such as Minikube. If you do want to specify resources, uncomment the following
6972
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
70-
# limits:
71-
# cpu: 100m
72-
# memory: 128Mi
73-
# requests:
74-
# cpu: 100m
75-
# memory: 128Mi
73+
limits:
74+
cpu: 100m
75+
memory: 256Mi
76+
requests:
77+
cpu: 100m
78+
memory: 256Mi
7679

7780
nodeSelector: {}
7881

0 commit comments

Comments
 (0)