diff --git a/charts/steadybit-extension-postman/Chart.yaml b/charts/steadybit-extension-postman/Chart.yaml index a79773f..fede700 100644 --- a/charts/steadybit-extension-postman/Chart.yaml +++ b/charts/steadybit-extension-postman/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: steadybit-extension-postman description: Steadybit Postman extension Helm chart for Kubernetes. -version: 1.7.9 +version: 1.7.10 appVersion: v2.0.7 home: https://www.steadybit.com/ icon: https://steadybit-website-assets.s3.amazonaws.com/logo-symbol-transparent.png diff --git a/charts/steadybit-extension-postman/templates/deployment.yaml b/charts/steadybit-extension-postman/templates/deployment.yaml index b067eee..b2cea60 100644 --- a/charts/steadybit-extension-postman/templates/deployment.yaml +++ b/charts/steadybit-extension-postman/templates/deployment.yaml @@ -90,15 +90,10 @@ spec: httpGet: path: /health/readiness port: 8087 + {{- with .Values.containerSecurityContext }} securityContext: - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 10000 - runAsGroup: 10000 - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL + {{- toYaml . | nindent 12 }} + {{- end }} volumes: - name: tmp-dir emptyDir: { } diff --git a/charts/steadybit-extension-postman/tests/__snapshot__/deployment_test.yaml.snap b/charts/steadybit-extension-postman/tests/__snapshot__/deployment_test.yaml.snap index 7d14d0c..0c676e0 100644 --- a/charts/steadybit-extension-postman/tests/__snapshot__/deployment_test.yaml.snap +++ b/charts/steadybit-extension-postman/tests/__snapshot__/deployment_test.yaml.snap @@ -71,12 +71,13 @@ manifest should match snapshot using podAnnotations and Labels: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: - mountPath: /tmp name: tmp-dir + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-postman volumes: - emptyDir: {} @@ -156,15 +157,16 @@ manifest should match snapshot with TLS: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: - mountPath: /tmp name: tmp-dir - mountPath: /etc/extension/certificates/server-cert name: certificate-server-cert readOnly: true + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-postman volumes: - emptyDir: {} @@ -251,12 +253,13 @@ manifest should match snapshot with extra env vars: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: - mountPath: /tmp name: tmp-dir + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-postman volumes: - emptyDir: {} @@ -334,12 +337,13 @@ manifest should match snapshot with extra labels: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: - mountPath: /tmp name: tmp-dir + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-postman volumes: - emptyDir: {} @@ -421,9 +425,6 @@ manifest should match snapshot with mutual TLS: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: - mountPath: /tmp name: tmp-dir @@ -433,6 +434,10 @@ manifest should match snapshot with mutual TLS: - mountPath: /etc/extension/certificates/server-cert name: certificate-server-cert readOnly: true + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-postman volumes: - emptyDir: {} @@ -522,12 +527,13 @@ manifest should match snapshot with mutual TLS using containerPaths: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: - mountPath: /tmp name: tmp-dir + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-postman volumes: - emptyDir: {} @@ -603,14 +609,14 @@ manifest should match snapshot with podSecurityContext: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: - mountPath: /tmp name: tmp-dir securityContext: + runAsNonRoot: true runAsUser: 2222 + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-postman volumes: - emptyDir: {} @@ -686,13 +692,14 @@ manifest should match snapshot with priority class: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: - mountPath: /tmp name: tmp-dir priorityClassName: my-priority-class + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-postman volumes: - emptyDir: {} @@ -768,12 +775,13 @@ manifest should match snapshot without TLS: drop: - ALL readOnlyRootFilesystem: true - runAsGroup: 10000 - runAsNonRoot: true - runAsUser: 10000 volumeMounts: - mountPath: /tmp name: tmp-dir + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: steadybit-extension-postman volumes: - emptyDir: {} diff --git a/charts/steadybit-extension-postman/values.yaml b/charts/steadybit-extension-postman/values.yaml index c531722..71d389e 100644 --- a/charts/steadybit-extension-postman/values.yaml +++ b/charts/steadybit-extension-postman/values.yaml @@ -98,7 +98,18 @@ affinity: {} priorityClassName: null # podSecurityContext -- SecurityContext to apply to the pod. -podSecurityContext: {} +podSecurityContext: + seccompProfile: + type: RuntimeDefault + runAsNonRoot: true + +# containerSecurityContext -- SecurityContext to apply to the container. +containerSecurityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL # extraEnv -- Array with extra environment variables to add to the container # e.g: