From 5b6732ca7b1bd595e94290c92da4f5fd7d932f9e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Javier=20J=2E=20Salmer=C3=B3n-Garc=C3=ADa?= Date: Thu, 29 Feb 2024 12:02:25 +0100 Subject: [PATCH] [bitnami/haproxy] feat: :sparkles: :lock: Add readOnlyRootFilesystem support (#23912) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Javier Salmeron Garcia Signed-off-by: Rafael Ríos Saavedra Co-authored-by: Rafael Ríos Saavedra --- bitnami/haproxy/Chart.yaml | 2 +- bitnami/haproxy/README.md | 1 + bitnami/haproxy/templates/deployment.yaml | 5 +++++ bitnami/haproxy/values.yaml | 2 ++ 4 files changed, 9 insertions(+), 1 deletion(-) diff --git a/bitnami/haproxy/Chart.yaml b/bitnami/haproxy/Chart.yaml index 8b1440a44a..9c372df32d 100644 --- a/bitnami/haproxy/Chart.yaml +++ b/bitnami/haproxy/Chart.yaml @@ -28,4 +28,4 @@ maintainers: name: haproxy sources: - https://github.com/bitnami/charts/tree/main/bitnami/haproxy -version: 0.16.3 +version: 0.17.0 diff --git a/bitnami/haproxy/README.md b/bitnami/haproxy/README.md index cda9b49cb9..a175a8d296 100644 --- a/bitnami/haproxy/README.md +++ b/bitnami/haproxy/README.md @@ -156,6 +156,7 @@ The command removes all the Kubernetes components associated with the chart and | `containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | | `containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` | | `containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` | | `containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | | `containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | | `containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` | diff --git a/bitnami/haproxy/templates/deployment.yaml b/bitnami/haproxy/templates/deployment.yaml index 86e3e16734..9d6f333620 100644 --- a/bitnami/haproxy/templates/deployment.yaml +++ b/bitnami/haproxy/templates/deployment.yaml @@ -165,6 +165,9 @@ spec: volumeMounts: - name: haproxy-conf mountPath: /bitnami/haproxy/conf + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir {{- if .Values.extraVolumeMounts }} {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }} {{- end }} @@ -172,6 +175,8 @@ spec: {{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" $) | nindent 8 }} {{- end }} volumes: + - name: empty-dir + emptyDir: {} - name: haproxy-conf configMap: name: {{ include "haproxy.configMapName" . }} diff --git a/bitnami/haproxy/values.yaml b/bitnami/haproxy/values.yaml index d5f091830e..aec4a9508d 100644 --- a/bitnami/haproxy/values.yaml +++ b/bitnami/haproxy/values.yaml @@ -398,6 +398,7 @@ podSecurityContext: ## @param containerSecurityContext.enabled Enabled containers' Security Context ## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container ## @param containerSecurityContext.runAsUser Set containers' Security Context runAsUser +## @param containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup ## @param containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot ## @param containerSecurityContext.privileged Set container's Security Context privileged ## @param containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem @@ -409,6 +410,7 @@ containerSecurityContext: enabled: true seLinuxOptions: null runAsUser: 1001 + runAsGroup: 0 runAsNonRoot: true privileged: false readOnlyRootFilesystem: false