Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-03-05 14:57:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/ejbca] fix: 🔒 Improve podSecurityContext and containerSecurityContext with essential security fields (#22113)

Browse Source 
* [bitnami/ejbca] fix: 🔒 Improve podSecurityContext and containerSecurityContext with essential security fields

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

* chore: 🔧 Bump chart version

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

---------

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
2024-01-16 16:24:45 +01:00
committed by GitHub
parent dc6338611f
commit 9ede461068
3 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bitnami/ejbca/Chart.yaml
View File

@@ -35,4 +35,4 @@ maintainers:
name: ejbca
sources:
- https://github.com/bitnami/charts/tree/main/bitnami/ejbca
version: 11.0.1
version: 11.1.0

4
bitnami/ejbca/README.md
View File

@@ -95,6 +95,9 @@ The command removes all the Kubernetes components associated with the chart and
| `podAnnotations` | Additional pod annotations | `{}` |
| `podLabels` | Additional pod labels | `{}` |
| `podSecurityContext.enabled` | Enable security context for EJBCA container | `true` |
| `podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` |
| `podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` |
| `podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
| `podSecurityContext.fsGroup` | Group ID for the volumes of the pod | `1001` |
| `podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` |
@@ -135,6 +138,7 @@ The command removes all the Kubernetes components associated with the chart and
| `resources.limits` | The resources limits for Ejbca containers | `{}` |
| `resources.requests` | The requested resources for Ejbca containers | `{}` |
| `containerSecurityContext.enabled` | Enabled EJBCA containers' Security Context | `true` |
| `containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` |
| `containerSecurityContext.runAsUser` | Set EJBCA containers' Security Context runAsUser | `1001` |
| `containerSecurityContext.runAsNonRoot` | Set Controller container's Security Context runAsNonRoot | `true` |
| `containerSecurityContext.privileged` | Set primary container's Security Context privileged | `false` |

8
bitnami/ejbca/values.yaml
View File

@@ -124,10 +124,16 @@ podLabels: {}
## K8s Security Context for EJBCA pods
## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
## @param podSecurityContext.enabled Enable security context for EJBCA container
## @param podSecurityContext.fsGroupChangePolicy Set filesystem group change policy
## @param podSecurityContext.sysctls Set kernel settings using the sysctl interface
## @param podSecurityContext.supplementalGroups Set filesystem extra groups
## @param podSecurityContext.fsGroup Group ID for the volumes of the pod
##
podSecurityContext:
enabled: true
fsGroupChangePolicy: Always
sysctls: []
supplementalGroups: []
fsGroup: 1001
## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
@@ -327,6 +333,7 @@ resources:
requests: {}
## K8s Security Context for EJBCA container
## @param containerSecurityContext.enabled Enabled EJBCA containers' Security Context
## @param containerSecurityContext.seLinuxOptions Set SELinux options in container
## @param containerSecurityContext.runAsUser Set EJBCA containers' Security Context runAsUser
## @param containerSecurityContext.runAsNonRoot Set Controller container's Security Context runAsNonRoot
## @param containerSecurityContext.privileged Set primary container's Security Context privileged
@@ -336,6 +343,7 @@ resources:
##
containerSecurityContext:
enabled: true
seLinuxOptions: {}
runAsUser: 1001
runAsNonRoot: true
privileged: false