diff --git a/.VERSION b/.VERSION index 7c7e1c3d..1faf6dcc 100644 --- a/.VERSION +++ b/.VERSION @@ -1 +1 @@ -version: v0.0.60 +version: v0.0.61 diff --git a/build/package/Dockerfile.run b/build/package/Dockerfile.run index cc51fd14..a1e9489f 100644 --- a/build/package/Dockerfile.run +++ b/build/package/Dockerfile.run @@ -5,4 +5,7 @@ RUN apk add --update --no-cache ca-certificates COPY Reloader /bin/Reloader +# On alpine 'nobody' has uid 65534 +USER 65534 + ENTRYPOINT ["/bin/Reloader"] diff --git a/deployments/kubernetes/chart/reloader/Chart.yaml b/deployments/kubernetes/chart/reloader/Chart.yaml index 89aa7f4e..a9a139c7 100644 --- a/deployments/kubernetes/chart/reloader/Chart.yaml +++ b/deployments/kubernetes/chart/reloader/Chart.yaml @@ -3,8 +3,8 @@ apiVersion: v1 name: reloader description: Reloader chart that runs on kubernetes -version: v0.0.60 -appVersion: v0.0.60 +version: v0.0.61 +appVersion: v0.0.61 keywords: - Reloader - kubernetes diff --git a/deployments/kubernetes/chart/reloader/values.yaml b/deployments/kubernetes/chart/reloader/values.yaml index 7e610da3..0fd2e538 100644 --- a/deployments/kubernetes/chart/reloader/values.yaml +++ b/deployments/kubernetes/chart/reloader/values.yaml @@ -32,6 +32,10 @@ reloader: # operator: "Exists" affinity: {} + securityContext: + runAsNonRoot: true + runAsUser: 65534 + # A list of tolerations to be applied to the Deployment. # Example: # tolerations: @@ -44,10 +48,10 @@ reloader: labels: provider: stakater group: com.stakater.platform - version: v0.0.60 + version: v0.0.61 image: name: stakater/reloader - tag: "v0.0.60" + tag: "v0.0.61" pullPolicy: IfNotPresent # Support for extra environment variables. env: diff --git a/deployments/kubernetes/manifests/clusterrole.yaml b/deployments/kubernetes/manifests/clusterrole.yaml index 71d148aa..0ef6bec5 100644 --- a/deployments/kubernetes/manifests/clusterrole.yaml +++ b/deployments/kubernetes/manifests/clusterrole.yaml @@ -6,7 +6,7 @@ kind: ClusterRole metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" name: reloader-reloader-role diff --git a/deployments/kubernetes/manifests/clusterrolebinding.yaml b/deployments/kubernetes/manifests/clusterrolebinding.yaml index a71b7932..42c3a579 100644 --- a/deployments/kubernetes/manifests/clusterrolebinding.yaml +++ b/deployments/kubernetes/manifests/clusterrolebinding.yaml @@ -6,7 +6,7 @@ kind: ClusterRoleBinding metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" name: reloader-reloader-role-binding diff --git a/deployments/kubernetes/manifests/deployment.yaml b/deployments/kubernetes/manifests/deployment.yaml index 6ddc1bba..376ea06e 100644 --- a/deployments/kubernetes/manifests/deployment.yaml +++ b/deployments/kubernetes/manifests/deployment.yaml @@ -5,12 +5,12 @@ kind: Deployment metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" group: com.stakater.platform provider: stakater - version: v0.0.60 + version: v0.0.61 name: reloader-reloader spec: @@ -24,17 +24,21 @@ spec: metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" group: com.stakater.platform provider: stakater - version: v0.0.60 + version: v0.0.61 spec: containers: - - image: "stakater/reloader:v0.0.60" + - image: "stakater/reloader:v0.0.61" imagePullPolicy: IfNotPresent name: reloader-reloader + securityContext: + runAsNonRoot: true + runAsUser: 65534 + serviceAccountName: reloader-reloader diff --git a/deployments/kubernetes/manifests/serviceaccount.yaml b/deployments/kubernetes/manifests/serviceaccount.yaml index d45aa13f..4933e2c3 100644 --- a/deployments/kubernetes/manifests/serviceaccount.yaml +++ b/deployments/kubernetes/manifests/serviceaccount.yaml @@ -6,7 +6,7 @@ kind: ServiceAccount metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" name: reloader-reloader diff --git a/deployments/kubernetes/reloader.yaml b/deployments/kubernetes/reloader.yaml index c7ad1373..0960dc0b 100644 --- a/deployments/kubernetes/reloader.yaml +++ b/deployments/kubernetes/reloader.yaml @@ -6,7 +6,7 @@ kind: ClusterRole metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" name: reloader-reloader-role @@ -51,7 +51,7 @@ kind: ClusterRoleBinding metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" name: reloader-reloader-role-binding @@ -72,12 +72,12 @@ kind: Deployment metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" group: com.stakater.platform provider: stakater - version: v0.0.60 + version: v0.0.61 name: reloader-reloader spec: @@ -91,18 +91,22 @@ spec: metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" group: com.stakater.platform provider: stakater - version: v0.0.60 + version: v0.0.61 spec: containers: - - image: "stakater/reloader:v0.0.60" + - image: "stakater/reloader:v0.0.61" imagePullPolicy: IfNotPresent name: reloader-reloader + securityContext: + runAsNonRoot: true + runAsUser: 65534 + serviceAccountName: reloader-reloader --- @@ -124,7 +128,7 @@ kind: ServiceAccount metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" name: reloader-reloader diff --git a/deployments/kubernetes/templates/chart/values.yaml.tmpl b/deployments/kubernetes/templates/chart/values.yaml.tmpl index e2b433b1..9147212e 100644 --- a/deployments/kubernetes/templates/chart/values.yaml.tmpl +++ b/deployments/kubernetes/templates/chart/values.yaml.tmpl @@ -32,6 +32,10 @@ reloader: # operator: "Exists" affinity: {} + securityContext: + runAsNonRoot: true + runAsUser: 65534 + # A list of tolerations to be applied to the Deployment. # Example: # tolerations: diff --git a/docs/Reloader-with-Sealed-Secrets.md b/docs/Reloader-with-Sealed-Secrets.md index 4b7d9225..86a109e1 100644 --- a/docs/Reloader-with-Sealed-Secrets.md +++ b/docs/Reloader-with-Sealed-Secrets.md @@ -8,4 +8,4 @@ Below are the steps to use reloader with Sealed Secrets. 8. Install Reloader. 9. Once everything is setup, update the original secret at client and encrypt it with kubeseal to see reloader working. 10. Apply the updated sealed secret. -11. Reloader will resatart the pod to use that updated secret. \ No newline at end of file +11. Reloader will restart the pod to use that updated secret.