From 0fd8baa6d73c6cac275b1a64fd0990366880742b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Javier=20J=2E=20Salmer=C3=B3n-Garc=C3=ADa?= Date: Thu, 29 Feb 2024 11:58:07 +0100 Subject: [PATCH] [bitnami/metallb] feat: :sparkles: :lock: Add runAsGroup (#23969) Signed-off-by: Javier Salmeron Garcia --- bitnami/metallb/Chart.yaml | 2 +- bitnami/metallb/README.md | 6 ++++-- bitnami/metallb/values.yaml | 8 ++++++-- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/bitnami/metallb/Chart.yaml b/bitnami/metallb/Chart.yaml index 3cfcc0692b..8db2ae5616 100644 --- a/bitnami/metallb/Chart.yaml +++ b/bitnami/metallb/Chart.yaml @@ -35,4 +35,4 @@ maintainers: name: metallb sources: - https://github.com/bitnami/charts/tree/main/bitnami/metallb -version: 4.14.2 +version: 4.15.0 diff --git a/bitnami/metallb/README.md b/bitnami/metallb/README.md index 2112a0b141..b184278740 100644 --- a/bitnami/metallb/README.md +++ b/bitnami/metallb/README.md @@ -132,7 +132,8 @@ The command removes all the Kubernetes components associated with the chart and | `controller.podSecurityContext.fsGroup` | Set MetalLB Controller pod's Security Context fsGroup | `1001` | | `controller.containerSecurityContext.enabled` | Enabled MetalLB Controller containers' Security Context | `true` | | `controller.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` | -| `controller.containerSecurityContext.runAsUser` | Set MetalLB Controller containers' Security Context runAsUser | `1001` | +| `controller.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `controller.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | | `controller.containerSecurityContext.runAsNonRoot` | Set MetalLB Controller container's Security Context runAsNonRoot | `true` | | `controller.containerSecurityContext.allowPrivilegeEscalation` | Enables privilege Escalation context for the pod. | `false` | | `controller.containerSecurityContext.readOnlyRootFilesystem` | Allows the pod to mount the RootFS as ReadOnly | `true` | @@ -244,7 +245,8 @@ The command removes all the Kubernetes components associated with the chart and | `speaker.podSecurityContext.fsGroup` | Set Speaker pod's Security Context fsGroup | `0` | | `speaker.containerSecurityContext.enabled` | Enabled Speaker containers' Security Context | `true` | | `speaker.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` | -| `speaker.containerSecurityContext.runAsUser` | Set Speaker containers' Security Context runAsUser | `0` | +| `speaker.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `0` | +| `speaker.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` | | `speaker.containerSecurityContext.allowPrivilegeEscalation` | Enables privilege Escalation context for the pod. | `false` | | `speaker.containerSecurityContext.readOnlyRootFilesystem` | Allows the pod to mount the RootFS as ReadOnly | `true` | | `speaker.containerSecurityContext.capabilities.drop` | Drop capabilities for the securityContext | `[]` | diff --git a/bitnami/metallb/values.yaml b/bitnami/metallb/values.yaml index 3b62a8ed5a..dfc2141fde 100644 --- a/bitnami/metallb/values.yaml +++ b/bitnami/metallb/values.yaml @@ -302,7 +302,8 @@ controller: ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod ## @param controller.containerSecurityContext.enabled Enabled MetalLB Controller containers' Security Context ## @param controller.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container - ## @param controller.containerSecurityContext.runAsUser Set MetalLB Controller containers' Security Context runAsUser + ## @param controller.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param controller.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup ## @param controller.containerSecurityContext.runAsNonRoot Set MetalLB Controller container's Security Context runAsNonRoot ## @param controller.containerSecurityContext.allowPrivilegeEscalation Enables privilege Escalation context for the pod. ## @param controller.containerSecurityContext.readOnlyRootFilesystem Allows the pod to mount the RootFS as ReadOnly @@ -313,6 +314,7 @@ controller: enabled: true seLinuxOptions: null runAsUser: 1001 + runAsGroup: 1001 runAsNonRoot: true allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -741,7 +743,8 @@ speaker: ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod ## @param speaker.containerSecurityContext.enabled Enabled Speaker containers' Security Context ## @param speaker.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container - ## @param speaker.containerSecurityContext.runAsUser Set Speaker containers' Security Context runAsUser + ## @param speaker.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param speaker.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup ## @param speaker.containerSecurityContext.allowPrivilegeEscalation Enables privilege Escalation context for the pod. ## @param speaker.containerSecurityContext.readOnlyRootFilesystem Allows the pod to mount the RootFS as ReadOnly ## @param speaker.containerSecurityContext.capabilities.drop [array] Drop capabilities for the securityContext @@ -752,6 +755,7 @@ speaker: enabled: true seLinuxOptions: null runAsUser: 0 + runAsGroup: 0 allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: