Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-02-11 04:37:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/grafana] feat: ✨ 🔒 Add readOnlyRootFilesystem support (#23985)

Browse Source 
Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
2024-03-01 20:25:18 +01:00
committed by GitHub
parent 0011046d93
commit c122ccfbb3
4 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bitnami/grafana/Chart.yaml
View File

@@ -31,4 +31,4 @@ maintainers:
name: grafana
sources:
- https://github.com/bitnami/charts/tree/main/bitnami/grafana
version: 9.10.2
version: 9.11.0

1
bitnami/grafana/README.md
View File

@@ -248,6 +248,7 @@ This solution allows to easily deploy multiple Grafana instances compared to the
| `grafana.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `grafana.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `grafana.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `grafana.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` |
| `grafana.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `grafana.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `grafana.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |

14
bitnami/grafana/templates/deployment.yaml
View File

@@ -96,6 +96,9 @@ spec:
resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: data
mountPath: /bitnami/grafana
{{- end }}
@@ -170,6 +173,15 @@ spec:
{{- include "common.tplvalues.render" (dict "value" .Values.grafana.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/grafana/conf
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/grafana/tmp
subPath: app-tmp-dir
{{- if .Values.config.useGrafanaIniFile }}
- name: grafana-ini
mountPath: /opt/bitnami/grafana/conf/grafana.ini
@@ -281,6 +293,8 @@ spec:
{{- include "common.tplvalues.render" (dict "value" .Values.grafana.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
- name: data
{{- if .Values.persistence.enabled }}
persistentVolumeClaim:

4
bitnami/grafana/values.yaml
View File

@@ -55,7 +55,7 @@ commonAnnotations: {}
image:
registry: docker.io
repository: bitnami/grafana
tag: 10.3.3-debian-12-r3
tag: 10.3.3-debian-12-r4
digest: ""
## Specify a imagePullPolicy
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
@@ -394,6 +394,7 @@ grafana:
## @param grafana.containerSecurityContext.enabled Enabled containers' Security Context
## @param grafana.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param grafana.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param grafana.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param grafana.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param grafana.containerSecurityContext.privileged Set container's Security Context privileged
## @param grafana.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
@@ -405,6 +406,7 @@ grafana:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false