From 99f30b38d14d30cd8bdfaa4a1ea69df5c58200a3 Mon Sep 17 00:00:00 2001 From: devOpsHelm <54980549+devOpsHelm@users.noreply.github.com> Date: Mon, 2 Mar 2020 17:04:43 +0300 Subject: [PATCH] Add runAsGroup in SecurityContext (#101) (#21173) Signed-off-by: devOpsHelm --- stable/hazelcast/Chart.yaml | 2 +- stable/hazelcast/README.adoc | 5 ++++- stable/hazelcast/templates/mancenter-statefulset.yaml | 2 ++ stable/hazelcast/templates/statefulset.yaml | 2 ++ stable/hazelcast/templates/tests/test-hazelcast.yaml | 2 ++ stable/hazelcast/templates/tests/test-management-center.yaml | 2 ++ stable/hazelcast/values.yaml | 2 ++ 7 files changed, 15 insertions(+), 2 deletions(-) diff --git a/stable/hazelcast/Chart.yaml b/stable/hazelcast/Chart.yaml index 0ef62f013a..a8d6af474a 100644 --- a/stable/hazelcast/Chart.yaml +++ b/stable/hazelcast/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: hazelcast -version: 3.0.3 +version: 3.0.4 appVersion: "4.0" tillerVersion: ">=2.7.2" kubeVersion: ">=1.9.0-0" diff --git a/stable/hazelcast/README.adoc b/stable/hazelcast/README.adoc index 2614d4f06c..69942233a9 100644 --- a/stable/hazelcast/README.adoc +++ b/stable/hazelcast/README.adoc @@ -195,6 +195,9 @@ Management Center |`+true+` |`+securityContext.runAsUser+` |User ID used to run the Hazelcast and Management Center containers |`+65534+` +| `securityContext.runAsGroup` |Primary Group ID used to run all processes in the + Hazelcast Jet and Hazelcast Jet Management Center containers | `+65534+` + |`+securityContext.fsGroup+` |Group ID associated with the Hazelcast and Management Center container |`+65534+` @@ -395,4 +398,4 @@ rest-api: enabled: true CLUSTER_WRITE: enabled: true ----- \ No newline at end of file +---- diff --git a/stable/hazelcast/templates/mancenter-statefulset.yaml b/stable/hazelcast/templates/mancenter-statefulset.yaml index 87699f0ea1..c5e5de2a6a 100644 --- a/stable/hazelcast/templates/mancenter-statefulset.yaml +++ b/stable/hazelcast/templates/mancenter-statefulset.yaml @@ -41,6 +41,7 @@ spec: securityContext: runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }} runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} fsGroup: {{ .Values.securityContext.fsGroup }} {{- if .Values.mancenter.affinity }} affinity: @@ -106,6 +107,7 @@ spec: securityContext: runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }} runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} privileged: false readOnlyRootFilesystem: false allowPrivilegeEscalation: false diff --git a/stable/hazelcast/templates/statefulset.yaml b/stable/hazelcast/templates/statefulset.yaml index 2516ae2c31..a433d6116a 100644 --- a/stable/hazelcast/templates/statefulset.yaml +++ b/stable/hazelcast/templates/statefulset.yaml @@ -43,6 +43,7 @@ spec: securityContext: runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }} runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} fsGroup: {{ .Values.securityContext.fsGroup }} {{- if .Values.affinity }} affinity: @@ -114,6 +115,7 @@ spec: securityContext: runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }} runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} privileged: false readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFilesystem }} allowPrivilegeEscalation: false diff --git a/stable/hazelcast/templates/tests/test-hazelcast.yaml b/stable/hazelcast/templates/tests/test-hazelcast.yaml index cd1668a754..8d0d810db2 100644 --- a/stable/hazelcast/templates/tests/test-hazelcast.yaml +++ b/stable/hazelcast/templates/tests/test-hazelcast.yaml @@ -19,6 +19,7 @@ spec: securityContext: runAsNonRoot: true runAsUser: 1001 + runAsGroup: 1001 {{- if .Values.nodeSelector }} nodeSelector: {{ toYaml .Values.nodeSelector | indent 4 }} @@ -38,6 +39,7 @@ spec: securityContext: runAsNonRoot: true runAsUser: 1001 + runAsGroup: 1001 privileged: false readOnlyRootFilesystem: true allowPrivilegeEscalation: false diff --git a/stable/hazelcast/templates/tests/test-management-center.yaml b/stable/hazelcast/templates/tests/test-management-center.yaml index f8b35f0cfd..4b342ed21c 100644 --- a/stable/hazelcast/templates/tests/test-management-center.yaml +++ b/stable/hazelcast/templates/tests/test-management-center.yaml @@ -19,6 +19,7 @@ spec: securityContext: runAsNonRoot: true runAsUser: 1001 + runAsGroup: 1001 {{- if .Values.nodeSelector }} nodeSelector: {{ toYaml .Values.nodeSelector | indent 4 }} @@ -38,6 +39,7 @@ spec: securityContext: runAsNonRoot: true runAsUser: 1001 + runAsGroup: 1001 privileged: false readOnlyRootFilesystem: true allowPrivilegeEscalation: false diff --git a/stable/hazelcast/values.yaml b/stable/hazelcast/values.yaml index 165e50037d..f370d9629e 100644 --- a/stable/hazelcast/values.yaml +++ b/stable/hazelcast/values.yaml @@ -168,6 +168,8 @@ securityContext: enabled: true # runAsUser is the user ID used to run the container runAsUser: 65534 + # runAsGroup is the primary group ID used to run all processes within any container of the pod + runAsGroup: 65534 # fsGroup is the group ID associated with the container fsGroup: 65534 # readOnlyRootFilesystem is a flag to enable readOnlyRootFilesystem for the Hazelcast security context