Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-08-10 14:15:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/supabase] feat: ✨ 🔒 Add readOnlyRootFilesystem support (#23888)

Browse Source 
Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
2024-02-23 17:49:56 +01:00
committed by GitHub
parent 50b25b83cb
commit 12480247ce
11 changed files with 105 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bitnami/supabase/Chart.yaml
+1 -1
View File
@@ -53,4 +53,4 @@ maintainers:
name: supabase
sources:
- https://github.com/bitnami/charts/tree/main/bitnami/supabase
version: 2.9.2
version: 2.10.0
bitnami/supabase/README.md
+7
View File
@@ -111,6 +111,7 @@ The command removes all the Kubernetes components associated with the chart and
| `jwt.autoGenerate.containerSecurityContext.enabled` | Enabled jwt init job containers' Security Context | `true` |
| `jwt.autoGenerate.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `jwt.autoGenerate.containerSecurityContext.runAsUser` | Set jwt init job containers' Security Context runAsUser | `1001` |
| `jwt.autoGenerate.containerSecurityContext.runAsGroup` | Set jwt init job containers' Security Context runAsUser | `0` |
| `jwt.autoGenerate.containerSecurityContext.runAsNonRoot` | Set jwt init job container's Security Context runAsNonRoot | `true` |
| `jwt.autoGenerate.containerSecurityContext.privileged` | Set jwt init job container's Security Context privileged | `false` |
| `jwt.autoGenerate.containerSecurityContext.readOnlyRootFilesystem` | Set jwt init job container's Security Context readOnlyRootFilesystem | `false` |
@@ -183,6 +184,7 @@ The command removes all the Kubernetes components associated with the chart and
| `auth.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `auth.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `auth.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `auth.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` |
| `auth.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `auth.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `auth.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
@@ -287,6 +289,7 @@ The command removes all the Kubernetes components associated with the chart and
| `meta.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `meta.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `meta.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `meta.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` |
| `meta.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `meta.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `meta.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
@@ -394,6 +397,7 @@ The command removes all the Kubernetes components associated with the chart and
| `realtime.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `realtime.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `realtime.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `realtime.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` |
| `realtime.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `realtime.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `realtime.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
@@ -498,6 +502,7 @@ The command removes all the Kubernetes components associated with the chart and
| `rest.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `rest.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `rest.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `rest.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` |
| `rest.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `rest.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `rest.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
@@ -602,6 +607,7 @@ The command removes all the Kubernetes components associated with the chart and
| `storage.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `storage.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `storage.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `storage.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` |
| `storage.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `storage.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `storage.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
@@ -722,6 +728,7 @@ The command removes all the Kubernetes components associated with the chart and
| `studio.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `studio.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `studio.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `studio.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` |
| `studio.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `studio.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `studio.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
bitnami/supabase/templates/_helpers.tpl
+4
View File
@@ -534,6 +534,10 @@ Return the PostgreSQL User
value: {{ include "supabase.database.user" . | quote }}
- name: DATABASE_NAME
value: {{ include "supabase.database.name" . | quote }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- end -}}
{{/*
bitnami/supabase/templates/auth/deployment.yaml
+6
View File
@@ -182,6 +182,10 @@ spec:
{{- if .Values.auth.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.auth.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.auth.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.auth.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
@@ -189,6 +193,8 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.auth.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
{{- if .Values.auth.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.auth.extraVolumes "context" $) | nindent 8 }}
{{- end }}
bitnami/supabase/templates/jwt-init-job.yaml
+8
View File
@@ -95,6 +95,9 @@ spec:
volumeMounts:
- name: secret-files
mountPath: /bitnami/supabase/secrets
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.jwt.autoGenerate.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.jwt.autoGenerate.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
@@ -135,6 +138,9 @@ spec:
volumeMounts:
- name: secret-files
mountPath: /bitnami/supabase/secrets
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.jwt.autoGenerate.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.jwt.autoGenerate.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
@@ -144,6 +150,8 @@ spec:
resources: {{- include "common.resources.preset" (dict "type" .Values.jwt.autoGenerate.resourcesPreset) | nindent 12 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
- name: secret-files
emptyDir: {}
{{- if .Values.extraVolumes }}
bitnami/supabase/templates/meta/deployment.yaml
+11
View File
@@ -161,6 +161,15 @@ spec:
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.meta.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /.npm/_logs
subPath: npm-logs-dir
- name: empty-dir
mountPath: /.npm/_cacache
subPath: npm-cache-dir
{{- if .Values.meta.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.meta.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
@@ -168,6 +177,8 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.meta.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
{{- if .Values.meta.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.meta.extraVolumes "context" $) | nindent 8 }}
{{- end }}
bitnami/supabase/templates/realtime/deployment.yaml
+32
View File
@@ -80,6 +80,30 @@ spec:
{{- if not .Values.diagnosticMode.enabled }}
{{- include "supabase.waitForDBInitContainer" . | nindent 8 }}
{{- end }}
- name: create-tzdata-priv
image: {{ template "supabase.realtime.image" . }}
imagePullPolicy: {{ .Values.realtime.image.pullPolicy }}
{{- if .Values.realtime.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.realtime.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
command:
- /bin/bash
args:
- -ec
- |
cp -r /opt/bitnami/supabase-realtime/lib/tzdata-*/priv/* /priv
{{- if .Values.realtime.resources }}
resources: {{- toYaml .Values.realtime.resources | nindent 12 }}
{{- else if ne .Values.realtime.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.realtime.resourcesPreset) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /priv
subPath: app-tzdata-dir
{{- if .Values.realtime.initContainers }}
{{- include "common.tplvalues.render" (dict "value" .Values.realtime.initContainers "context" $) | nindent 8 }}
{{- end }}
@@ -180,6 +204,12 @@ spec:
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.realtime.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /.tzdata-priv
subPath: app-tzdata-dir
{{- if .Values.realtime.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.realtime.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
@@ -187,6 +217,8 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.realtime.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
{{- if .Values.realtime.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.realtime.extraVolumes "context" $) | nindent 8 }}
{{- end }}
bitnami/supabase/templates/rest/deployment.yaml
+5
View File
@@ -178,6 +178,9 @@ spec:
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.rest.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.rest.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.rest.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
@@ -185,6 +188,8 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.rest.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
{{- if .Values.rest.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.rest.extraVolumes "context" $) | nindent 8 }}
{{- end }}
bitnami/supabase/templates/storage/deployment.yaml
+11
View File
@@ -95,6 +95,9 @@ spec:
- name: data
mountPath: {{ .Values.storage.persistence.mountPath }}
subPath: {{ .Values.storage.persistence.subPath }}
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- end }}
{{- include "supabase.waitForDBInitContainer" . | nindent 8 }}
{{- end }}
@@ -216,6 +219,12 @@ spec:
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.storage.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /.pm2
subPath: app-pm2-dir
- name: data
mountPath: {{ .Values.storage.persistence.mountPath }}
{{- if .Values.storage.persistence.subPath }}
@@ -228,6 +237,8 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.storage.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
- name: data
{{- if .Values.storage.persistence.enabled }}
persistentVolumeClaim:
bitnami/supabase/templates/studio/deployment.yaml
+5
View File
@@ -169,6 +169,9 @@ spec:
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.studio.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.studio.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.studio.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
@@ -176,6 +179,8 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.studio.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
{{- if .Values.studio.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.studio.extraVolumes "context" $) | nindent 8 }}
{{- end }}
bitnami/supabase/values.yaml
+15 -1
View File
@@ -170,6 +170,7 @@ jwt:
## @param jwt.autoGenerate.containerSecurityContext.enabled Enabled jwt init job containers' Security Context
## @param jwt.autoGenerate.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param jwt.autoGenerate.containerSecurityContext.runAsUser Set jwt init job containers' Security Context runAsUser
## @param jwt.autoGenerate.containerSecurityContext.runAsGroup Set jwt init job containers' Security Context runAsUser
## @param jwt.autoGenerate.containerSecurityContext.runAsNonRoot Set jwt init job container's Security Context runAsNonRoot
## @param jwt.autoGenerate.containerSecurityContext.privileged Set jwt init job container's Security Context privileged
## @param jwt.autoGenerate.containerSecurityContext.readOnlyRootFilesystem Set jwt init job container's Security Context readOnlyRootFilesystem
@@ -181,6 +182,7 @@ jwt:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
@@ -429,6 +431,7 @@ auth:
## @param auth.containerSecurityContext.enabled Enabled containers' Security Context
## @param auth.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param auth.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param auth.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param auth.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param auth.containerSecurityContext.privileged Set container's Security Context privileged
## @param auth.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
@@ -440,6 +443,7 @@ auth:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
@@ -829,6 +833,7 @@ meta:
## @param meta.containerSecurityContext.enabled Enabled containers' Security Context
## @param meta.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param meta.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param meta.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param meta.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param meta.containerSecurityContext.privileged Set container's Security Context privileged
## @param meta.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
@@ -840,6 +845,7 @@ meta:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
@@ -1137,7 +1143,7 @@ realtime:
image:
registry: docker.io
repository: bitnami/supabase-realtime
tag: 2.25.65-debian-12-r0
tag: 2.25.66-debian-12-r1
digest: ""
## Specify a imagePullPolicy
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
@@ -1245,6 +1251,7 @@ realtime:
## @param realtime.containerSecurityContext.enabled Enabled containers' Security Context
## @param realtime.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param realtime.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param realtime.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param realtime.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param realtime.containerSecurityContext.privileged Set container's Security Context privileged
## @param realtime.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
@@ -1256,6 +1263,7 @@ realtime:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
@@ -1643,6 +1651,7 @@ rest:
## @param rest.containerSecurityContext.enabled Enabled containers' Security Context
## @param rest.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param rest.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param rest.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param rest.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param rest.containerSecurityContext.privileged Set container's Security Context privileged
## @param rest.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
@@ -1654,6 +1663,7 @@ rest:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
@@ -2047,6 +2057,7 @@ storage:
## @param storage.containerSecurityContext.enabled Enabled containers' Security Context
## @param storage.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param storage.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param storage.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param storage.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param storage.containerSecurityContext.privileged Set container's Security Context privileged
## @param storage.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
@@ -2058,6 +2069,7 @@ storage:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
@@ -2496,6 +2508,7 @@ studio:
## @param studio.containerSecurityContext.enabled Enabled containers' Security Context
## @param studio.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param studio.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param studio.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param studio.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param studio.containerSecurityContext.privileged Set container's Security Context privileged
## @param studio.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
@@ -2507,6 +2520,7 @@ studio:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false