diff --git a/stable/parse/Chart.yaml b/stable/parse/Chart.yaml index b0dbd4c667..7971eca517 100644 --- a/stable/parse/Chart.yaml +++ b/stable/parse/Chart.yaml @@ -1,5 +1,5 @@ name: parse -version: 5.0.2 +version: 5.1.0 appVersion: 3.1.2 description: Parse is a platform that enables users to add a scalable and powerful backend to launch a full-featured app for iOS, Android, JavaScript, Windows, Unity, and more. keywords: diff --git a/stable/parse/README.md b/stable/parse/README.md index d8ccae63ae..0377393f52 100644 --- a/stable/parse/README.md +++ b/stable/parse/README.md @@ -45,44 +45,50 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the Parse chart and their default values. -| Parameter | Description | Default | -|------------------------------------|----------------------------------------|-------------------------------------------------------- | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `service.type` | Kubernetes Service type | `LoadBalancer` | -| `service.port` | Service HTTP port (Dashboard) | `80` | -| `service.loadBalancerIP` | `loadBalancerIP` for the Parse Service | `nil` | -| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | -| `service.nodePorts.http` | Kubernetes http node port | `""` | -| `server.image.registry` | Parse image registry | `docker.io` | -| `server.image.repository` | Parse image name | `bitnami/parse` | -| `server.image.tag` | Parse image tag | `{VERSION}` | -| `server.image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | -| `server.image.pullSecrets` | Specify image pull secrets | `nil` | -| `server.port` | Parse server server port | `1337` | -| `server.mountPath` | Parse server API mount path | `/parse` | -| `server.appId` | Parse server App Id | `myappID` | -| `server.masterKey` | Parse server Master Key | `random 10 character alphanumeric string` | -| `server.resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | -| `dashboard.enabled` | Enable parse dashboard | `true` | -| `dashboard.image.registry` | Dashboard image registry | `docker.io` | -| `dashboard.image.repository` | Dashboard image name | `bitnami/parse-dashboard` | -| `dashboard.image.tag` | Dashboard image tag | `{VERSION}` | -| `dashboard.image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | -| `dashboard.image.pullSecrets` | Specify image pull secrets | `nil` | -| `dashboard.username` | Dashboard username | `user` | -| `dashboard.password` | Dashboard user password | `random 10 character alphanumeric string` | -| `dashboard.appName` | Dashboard application name | `MyDashboard` | -| `dashboard.resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | -| `persistence.enabled` | Enable Parse persistence using PVC | `true` | -| `persistence.storageClass` | PVC Storage Class for Parse volume | `nil` (uses alpha storage class annotation) | -| `persistence.accessMode` | PVC Access Mode for Parse volume | `ReadWriteOnce` | -| `persistence.size` | PVC Storage Request for Parse volume | `8Gi` | -| `mongodb.usePassword` | Enable MongoDB password authentication | `true` | -| `mongodb.password` | MongoDB admin password | `nil` | -| `mongodb.persistence.enabled` | Enable MongoDB persistence using PVC | `true` | -| `mongodb.persistence.storageClass` | PVC Storage Class for MongoDB volume | `nil` (uses alpha storage class annotation) | -| `mongodb.persistence.accessMode` | PVC Access Mode for MongoDB volume | `ReadWriteOnce` | -| `mongodb.persistence.size` | PVC Storage Request for MongoDB volume | `8Gi` | +| Parameter | Description | Default | +|---------------------------------------|------------------------------------------|-------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `service.type` | Kubernetes Service type | `LoadBalancer` | +| `service.port` | Service HTTP port (Dashboard) | `80` | +| `service.loadBalancerIP` | `loadBalancerIP` for the Parse Service | `nil` | +| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `service.nodePorts.http` | Kubernetes http node port | `""` | +| `server.image.registry` | Parse image registry | `docker.io` | +| `server.image.repository` | Parse image name | `bitnami/parse` | +| `server.image.tag` | Parse image tag | `{VERSION}` | +| `server.image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | +| `server.image.pullSecrets` | Specify image pull secrets | `nil` | +| `server.securityContext.enabled` | Enable security context for Parse Server | `true` | +| `server.securityContext.fsGroup` | Group ID for Parse Server container | `1001` | +| `server.securityContext.runAsUser` | User ID for Parse Server container | `1001` | +| `server.port` | Parse server server port | `1337` | +| `server.mountPath` | Parse server API mount path | `/parse` | +| `server.appId` | Parse server App Id | `myappID` | +| `server.masterKey` | Parse server Master Key | `random 10 character alphanumeric string` | +| `server.resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | +| `dashboard.enabled` | Enable parse dashboard | `true` | +| `dashboard.image.registry` | Dashboard image registry | `docker.io` | +| `dashboard.image.repository` | Dashboard image name | `bitnami/parse-dashboard` | +| `dashboard.image.tag` | Dashboard image tag | `{VERSION}` | +| `dashboard.image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | +| `dashboard.securityContext.enabled` | Enable security context for Dashboard | `true` | +| `dashboard.securityContext.fsGroup` | Group ID for Dashboard container | `1001` | +| `dashboard.securityContext.runAsUser` | User ID for Dashboard container | `1001` | +| `dashboard.image.pullSecrets` | Specify image pull secrets | `nil` | +| `dashboard.username` | Dashboard username | `user` | +| `dashboard.password` | Dashboard user password | `random 10 character alphanumeric string` | +| `dashboard.appName` | Dashboard application name | `MyDashboard` | +| `dashboard.resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | +| `persistence.enabled` | Enable Parse persistence using PVC | `true` | +| `persistence.storageClass` | PVC Storage Class for Parse volume | `nil` (uses alpha storage class annotation) | +| `persistence.accessMode` | PVC Access Mode for Parse volume | `ReadWriteOnce` | +| `persistence.size` | PVC Storage Request for Parse volume | `8Gi` | +| `mongodb.usePassword` | Enable MongoDB password authentication | `true` | +| `mongodb.password` | MongoDB admin password | `nil` | +| `mongodb.persistence.enabled` | Enable MongoDB persistence using PVC | `true` | +| `mongodb.persistence.storageClass` | PVC Storage Class for MongoDB volume | `nil` (uses alpha storage class annotation) | +| `mongodb.persistence.accessMode` | PVC Access Mode for MongoDB volume | `ReadWriteOnce` | +| `mongodb.persistence.size` | PVC Storage Request for MongoDB volume | `8Gi` | The above parameters map to the env variables defined in [bitnami/parse](http://github.com/bitnami/bitnami-docker-parse). For more information please refer to the [bitnami/parse](http://github.com/bitnami/bitnami-docker-parse) image documentation. @@ -127,6 +133,20 @@ See the [Configuration](#configuration) section to configure the PVC or to disab ## Upgrading +### To 5.1.0 + +Parse & Parse Dashboard containers were moved to a non-root approach. There shouldn't be any issue when upgrading since the corresponding `securityContext` is enabled by default. Both container images and chart can be upgraded by running the command below: + +``` +$ helm upgrade my-release stable/parse +``` + +If you use a previous container image (previous to **3.1.2-r14** for Parse or **1.2.0-r69** for Parse Dashboard), disable the `securityContext` by running the command below: + +``` +$ helm upgrade my-release stable/parse --set server.securityContext.enabled=fase,dashboard.securityContext.enabled=fase,server.image.tag=XXX,dashboard.image.tag=YYY +``` + ### To 3.0.0 Backwards compatibility is not guaranteed unless you modify the labels used on the chart's deployments. diff --git a/stable/parse/templates/dashboard-deployment.yaml b/stable/parse/templates/dashboard-deployment.yaml index ff984e3a88..37243cfd53 100644 --- a/stable/parse/templates/dashboard-deployment.yaml +++ b/stable/parse/templates/dashboard-deployment.yaml @@ -24,6 +24,11 @@ spec: release: "{{ .Release.Name }}" component: "dashboard" spec: + {{- if .Values.dashboard.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.dashboard.securityContext.fsGroup }} + runAsUser: {{ .Values.dashboard.securityContext.runAsUser }} + {{- end }} {{- if .Values.dashboard.image.pullSecrets }} imagePullSecrets: {{- range .Values.dashboard.image.pullSecrets }} diff --git a/stable/parse/templates/server-deployment.yaml b/stable/parse/templates/server-deployment.yaml index 888f1be912..6bf5c21022 100644 --- a/stable/parse/templates/server-deployment.yaml +++ b/stable/parse/templates/server-deployment.yaml @@ -23,6 +23,11 @@ spec: release: "{{ .Release.Name }}" component: "server" spec: + {{- if .Values.server.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.server.securityContext.fsGroup }} + runAsUser: {{ .Values.server.securityContext.runAsUser }} + {{- end }} {{- if .Values.server.image.pullSecrets }} imagePullSecrets: {{- range .Values.server.image.pullSecrets }} diff --git a/stable/parse/values.yaml b/stable/parse/values.yaml index b98a6b4804..c1d873848b 100644 --- a/stable/parse/values.yaml +++ b/stable/parse/values.yaml @@ -39,7 +39,7 @@ server: ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## - pullPolicy: IfNotPresent + pullPolicy: Always ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ @@ -47,6 +47,14 @@ server: # pullSecrets: # - myRegistrKeySecretName + ## Parse Server Pod Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## + securityContext: + enabled: true + fsGroup: 1001 + runAsUser: 1001 + ## Parse Server Port ## ref: https://github.com/bitnami/bitnami-docker-parse#configuration ## @@ -91,7 +99,7 @@ dashboard: ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## - pullPolicy: IfNotPresent + pullPolicy: Always ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ @@ -99,6 +107,14 @@ dashboard: # pullSecrets: # - myRegistrKeySecretName + ## Parse Dashboard Pod Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## + securityContext: + enabled: true + fsGroup: 1001 + runAsUser: 1001 + ## Parse Dashboard application username ## ref: https://github.com/bitnami/bitnami-docker-parse-dashboard#configuration ##