From 388c9815c35fe5aa149edab2dfa544067fbfec63 Mon Sep 17 00:00:00 2001 From: Bort Verwilst Date: Mon, 3 Sep 2018 10:08:34 +0200 Subject: [PATCH] [stable/rocketchat] Bring it back to the present (#7463) * [stable/rocketchat] Update to latest version, upgrade mongodb to latest version, make sure it installs when using podsecuritypolicies Signed-off-by: Bart Verwilst * Add OWNERS file Signed-off-by: Bart Verwilst * Update Chart.yaml Signed-off-by: Bart Verwilst * Make user and group configurable Signed-off-by: Bart Verwilst * Add serviceaccount Signed-off-by: Bart Verwilst * fix sa Signed-off-by: Bart Verwilst * improve security context Signed-off-by: Bart Verwilst --- stable/rocketchat/Chart.yaml | 4 ++-- stable/rocketchat/OWNERS | 4 ++++ stable/rocketchat/requirements.lock | 6 +++--- stable/rocketchat/requirements.yaml | 2 +- stable/rocketchat/templates/_helpers.tpl | 12 ++++++++++++ stable/rocketchat/templates/deployment.yaml | 5 +++++ stable/rocketchat/templates/serviceaccount.yaml | 11 +++++++++++ stable/rocketchat/values.yaml | 15 ++++++++++++++- 8 files changed, 52 insertions(+), 7 deletions(-) create mode 100644 stable/rocketchat/OWNERS create mode 100644 stable/rocketchat/templates/serviceaccount.yaml diff --git a/stable/rocketchat/Chart.yaml b/stable/rocketchat/Chart.yaml index 4bcc7446e7..dc958882ff 100644 --- a/stable/rocketchat/Chart.yaml +++ b/stable/rocketchat/Chart.yaml @@ -1,6 +1,6 @@ name: rocketchat -version: 0.1.3 -appVersion: 0.56 +version: 0.1.4 +appVersion: 0.68.5 description: Prepare to take off with the ultimate chat platform, experience the next level of team communications keywords: diff --git a/stable/rocketchat/OWNERS b/stable/rocketchat/OWNERS new file mode 100644 index 0000000000..bfc8a2c1ad --- /dev/null +++ b/stable/rocketchat/OWNERS @@ -0,0 +1,4 @@ +approvers: +- verwilst +reviewers: +- verwilst diff --git a/stable/rocketchat/requirements.lock b/stable/rocketchat/requirements.lock index 120e2093c1..5e4f83d6ca 100644 --- a/stable/rocketchat/requirements.lock +++ b/stable/rocketchat/requirements.lock @@ -1,6 +1,6 @@ dependencies: - name: mongodb repository: https://kubernetes-charts.storage.googleapis.com/ - version: 0.4.15 -digest: sha256:1a4e23d283ae090cf7595d7e255a0804b66a20f94620a4063b1271b2aa8b0879 -generated: 2017-09-03T14:24:37.770010325-04:00 + version: 4.2.2 +digest: sha256:e0861bef41fadbe3d9f213bd1d103f0e266faf2c2a06d58ab11199d0dc4cfcf9 +generated: 2018-08-31T09:39:11.558129592Z diff --git a/stable/rocketchat/requirements.yaml b/stable/rocketchat/requirements.yaml index 3c4958aca4..e15761787f 100644 --- a/stable/rocketchat/requirements.yaml +++ b/stable/rocketchat/requirements.yaml @@ -1,4 +1,4 @@ dependencies: - name: mongodb - version: 0.4.15 + version: 4.2.2 repository: https://kubernetes-charts.storage.googleapis.com/ diff --git a/stable/rocketchat/templates/_helpers.tpl b/stable/rocketchat/templates/_helpers.tpl index 4547c27da9..8d235c83ef 100644 --- a/stable/rocketchat/templates/_helpers.tpl +++ b/stable/rocketchat/templates/_helpers.tpl @@ -22,3 +22,15 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- define "rocketchat.mongodb.fullname" -}} {{- printf "%s-%s" .Release.Name "mongodb" | trunc 63 | trimSuffix "-" -}} {{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "rocketchat.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "rocketchat.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + diff --git a/stable/rocketchat/templates/deployment.yaml b/stable/rocketchat/templates/deployment.yaml index 2c104e9960..877088fd16 100644 --- a/stable/rocketchat/templates/deployment.yaml +++ b/stable/rocketchat/templates/deployment.yaml @@ -15,6 +15,11 @@ spec: app: {{ template "rocketchat.name" . }} release: "{{ .Release.Name }}" spec: + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} containers: - name: {{ template "rocketchat.fullname" . }} image: "{{ .Values.image }}" diff --git a/stable/rocketchat/templates/serviceaccount.yaml b/stable/rocketchat/templates/serviceaccount.yaml new file mode 100644 index 0000000000..a903bc708c --- /dev/null +++ b/stable/rocketchat/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +{{ if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: {{ template "rocketchat.name" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "rocketchat.serviceAccountName" . }} +{{- end -}} diff --git a/stable/rocketchat/values.yaml b/stable/rocketchat/values.yaml index 7c68c74e7e..b906c5bf48 100644 --- a/stable/rocketchat/values.yaml +++ b/stable/rocketchat/values.yaml @@ -1,7 +1,7 @@ ## Rocket Chat image version ## ref: https://hub.docker.com/r/library/rocket.chat/tags/ ## -image: rocket.chat:0.56 +image: rocket.chat:0.68.5 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' @@ -85,6 +85,19 @@ persistence: # memory: 512Mi # cpu: 300m +securityContext: + enabled: true + runAsUser: 999 + fsGroup: 999 + +serviceAccount: + # Specifies whether a ServiceAccount should be created + create: true + + # The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template + name: + ## Configure the ingress object to hook into existing infastructure ### ref : http://kubernetes.io/docs/user-guide/ingress/ ###