From 16f3055e10570380bdc8dbc654a18fc00ab31787 Mon Sep 17 00:00:00 2001 From: "Paul \"TBBle\" Hampson" Date: Fri, 10 Jul 2020 11:34:47 +1000 Subject: [PATCH 1/4] Typo fix "resatart" --- docs/Reloader-with-Sealed-Secrets.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/Reloader-with-Sealed-Secrets.md b/docs/Reloader-with-Sealed-Secrets.md index 4b7d9225..86a109e1 100644 --- a/docs/Reloader-with-Sealed-Secrets.md +++ b/docs/Reloader-with-Sealed-Secrets.md @@ -8,4 +8,4 @@ Below are the steps to use reloader with Sealed Secrets. 8. Install Reloader. 9. Once everything is setup, update the original secret at client and encrypt it with kubeseal to see reloader working. 10. Apply the updated sealed secret. -11. Reloader will resatart the pod to use that updated secret. \ No newline at end of file +11. Reloader will restart the pod to use that updated secret. From 87130f06bcf66a3de22412f0e752463999e5d31e Mon Sep 17 00:00:00 2001 From: LucasBoisserie Date: Fri, 10 Jul 2020 17:34:49 +0200 Subject: [PATCH 2/4] Run as Non Root (#149) --- build/package/Dockerfile.run | 3 +++ deployments/kubernetes/chart/reloader/values.yaml | 4 ++++ deployments/kubernetes/manifests/deployment.yaml | 3 +++ deployments/kubernetes/reloader.yaml | 3 +++ 4 files changed, 13 insertions(+) diff --git a/build/package/Dockerfile.run b/build/package/Dockerfile.run index cc51fd14..a1e9489f 100644 --- a/build/package/Dockerfile.run +++ b/build/package/Dockerfile.run @@ -5,4 +5,7 @@ RUN apk add --update --no-cache ca-certificates COPY Reloader /bin/Reloader +# On alpine 'nobody' has uid 65534 +USER 65534 + ENTRYPOINT ["/bin/Reloader"] diff --git a/deployments/kubernetes/chart/reloader/values.yaml b/deployments/kubernetes/chart/reloader/values.yaml index 7e610da3..18413933 100644 --- a/deployments/kubernetes/chart/reloader/values.yaml +++ b/deployments/kubernetes/chart/reloader/values.yaml @@ -32,6 +32,10 @@ reloader: # operator: "Exists" affinity: {} + securityContext: + runAsNonRoot: true + runAsUser: 65534 + # A list of tolerations to be applied to the Deployment. # Example: # tolerations: diff --git a/deployments/kubernetes/manifests/deployment.yaml b/deployments/kubernetes/manifests/deployment.yaml index 4de0cc09..91b07058 100644 --- a/deployments/kubernetes/manifests/deployment.yaml +++ b/deployments/kubernetes/manifests/deployment.yaml @@ -39,4 +39,7 @@ spec: name: reloader-reloader args: serviceAccountName: reloader-reloader + securityContext: + runAsNonRoot: true + runAsUser: 65534 diff --git a/deployments/kubernetes/reloader.yaml b/deployments/kubernetes/reloader.yaml index 65528f12..517a5843 100644 --- a/deployments/kubernetes/reloader.yaml +++ b/deployments/kubernetes/reloader.yaml @@ -106,6 +106,9 @@ spec: name: reloader-reloader args: serviceAccountName: reloader-reloader + securityContext: + runAsNonRoot: true + runAsUser: 65534 --- # Source: reloader/templates/role.yaml From 86c2ed265d615b77c7f3585b3bca5e34b67b1649 Mon Sep 17 00:00:00 2001 From: kahootali Date: Fri, 10 Jul 2020 20:40:48 +0500 Subject: [PATCH 3/4] Add non-root security context --- deployments/kubernetes/templates/chart/values.yaml.tmpl | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/deployments/kubernetes/templates/chart/values.yaml.tmpl b/deployments/kubernetes/templates/chart/values.yaml.tmpl index e2b433b1..9147212e 100644 --- a/deployments/kubernetes/templates/chart/values.yaml.tmpl +++ b/deployments/kubernetes/templates/chart/values.yaml.tmpl @@ -32,6 +32,10 @@ reloader: # operator: "Exists" affinity: {} + securityContext: + runAsNonRoot: true + runAsUser: 65534 + # A list of tolerations to be applied to the Deployment. # Example: # tolerations: From 39b5be37af3eb87c54430ebe0dc0ed801ed377a6 Mon Sep 17 00:00:00 2001 From: stakater-user Date: Fri, 10 Jul 2020 15:54:41 +0000 Subject: [PATCH 4/4] Bump Version to v0.0.61 --- .VERSION | 2 +- .../kubernetes/chart/reloader/Chart.yaml | 4 ++-- .../kubernetes/chart/reloader/values.yaml | 4 ++-- .../kubernetes/manifests/clusterrole.yaml | 2 +- .../manifests/clusterrolebinding.yaml | 2 +- .../kubernetes/manifests/deployment.yaml | 15 ++++++------- .../kubernetes/manifests/serviceaccount.yaml | 2 +- deployments/kubernetes/reloader.yaml | 21 ++++++++++--------- 8 files changed, 27 insertions(+), 25 deletions(-) diff --git a/.VERSION b/.VERSION index 7c7e1c3d..1faf6dcc 100644 --- a/.VERSION +++ b/.VERSION @@ -1 +1 @@ -version: v0.0.60 +version: v0.0.61 diff --git a/deployments/kubernetes/chart/reloader/Chart.yaml b/deployments/kubernetes/chart/reloader/Chart.yaml index 89aa7f4e..a9a139c7 100644 --- a/deployments/kubernetes/chart/reloader/Chart.yaml +++ b/deployments/kubernetes/chart/reloader/Chart.yaml @@ -3,8 +3,8 @@ apiVersion: v1 name: reloader description: Reloader chart that runs on kubernetes -version: v0.0.60 -appVersion: v0.0.60 +version: v0.0.61 +appVersion: v0.0.61 keywords: - Reloader - kubernetes diff --git a/deployments/kubernetes/chart/reloader/values.yaml b/deployments/kubernetes/chart/reloader/values.yaml index 18413933..0fd2e538 100644 --- a/deployments/kubernetes/chart/reloader/values.yaml +++ b/deployments/kubernetes/chart/reloader/values.yaml @@ -48,10 +48,10 @@ reloader: labels: provider: stakater group: com.stakater.platform - version: v0.0.60 + version: v0.0.61 image: name: stakater/reloader - tag: "v0.0.60" + tag: "v0.0.61" pullPolicy: IfNotPresent # Support for extra environment variables. env: diff --git a/deployments/kubernetes/manifests/clusterrole.yaml b/deployments/kubernetes/manifests/clusterrole.yaml index 71d148aa..0ef6bec5 100644 --- a/deployments/kubernetes/manifests/clusterrole.yaml +++ b/deployments/kubernetes/manifests/clusterrole.yaml @@ -6,7 +6,7 @@ kind: ClusterRole metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" name: reloader-reloader-role diff --git a/deployments/kubernetes/manifests/clusterrolebinding.yaml b/deployments/kubernetes/manifests/clusterrolebinding.yaml index a71b7932..42c3a579 100644 --- a/deployments/kubernetes/manifests/clusterrolebinding.yaml +++ b/deployments/kubernetes/manifests/clusterrolebinding.yaml @@ -6,7 +6,7 @@ kind: ClusterRoleBinding metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" name: reloader-reloader-role-binding diff --git a/deployments/kubernetes/manifests/deployment.yaml b/deployments/kubernetes/manifests/deployment.yaml index 91b07058..0c5b167a 100644 --- a/deployments/kubernetes/manifests/deployment.yaml +++ b/deployments/kubernetes/manifests/deployment.yaml @@ -5,12 +5,12 @@ kind: Deployment metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" group: com.stakater.platform provider: stakater - version: v0.0.60 + version: v0.0.61 name: reloader-reloader spec: @@ -24,22 +24,23 @@ spec: metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" group: com.stakater.platform provider: stakater - version: v0.0.60 + version: v0.0.61 spec: containers: - env: - image: "stakater/reloader:v0.0.60" + image: "stakater/reloader:v0.0.61" imagePullPolicy: IfNotPresent name: reloader-reloader args: - serviceAccountName: reloader-reloader - securityContext: + securityContext: runAsNonRoot: true runAsUser: 65534 + + serviceAccountName: reloader-reloader diff --git a/deployments/kubernetes/manifests/serviceaccount.yaml b/deployments/kubernetes/manifests/serviceaccount.yaml index d45aa13f..4933e2c3 100644 --- a/deployments/kubernetes/manifests/serviceaccount.yaml +++ b/deployments/kubernetes/manifests/serviceaccount.yaml @@ -6,7 +6,7 @@ kind: ServiceAccount metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" name: reloader-reloader diff --git a/deployments/kubernetes/reloader.yaml b/deployments/kubernetes/reloader.yaml index 517a5843..46f1e9c6 100644 --- a/deployments/kubernetes/reloader.yaml +++ b/deployments/kubernetes/reloader.yaml @@ -6,7 +6,7 @@ kind: ClusterRole metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" name: reloader-reloader-role @@ -51,7 +51,7 @@ kind: ClusterRoleBinding metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" name: reloader-reloader-role-binding @@ -72,12 +72,12 @@ kind: Deployment metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" group: com.stakater.platform provider: stakater - version: v0.0.60 + version: v0.0.61 name: reloader-reloader spec: @@ -91,24 +91,25 @@ spec: metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" group: com.stakater.platform provider: stakater - version: v0.0.60 + version: v0.0.61 spec: containers: - env: - image: "stakater/reloader:v0.0.60" + image: "stakater/reloader:v0.0.61" imagePullPolicy: IfNotPresent name: reloader-reloader args: - serviceAccountName: reloader-reloader - securityContext: + securityContext: runAsNonRoot: true runAsUser: 65534 + + serviceAccountName: reloader-reloader --- # Source: reloader/templates/role.yaml @@ -129,7 +130,7 @@ kind: ServiceAccount metadata: labels: app: reloader-reloader - chart: "reloader-v0.0.60" + chart: "reloader-v0.0.61" release: "reloader" heritage: "Tiller" name: reloader-reloader