Skip to content

Commit a0ac8b8

Browse files
joshistejoshiste
authored
Merge pull request #76 from steadybit/refa/helm-no-hardcoded-uid
refa: avoid hard-coded uid in helm chart
2 parents 04ce952 + b2fb777 commit a0ac8b8

File tree

4 files changed

+63
-46
lines changed

4 files changed

+63
-46
lines changed

‎charts/steadybit-extension-jmeter/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v2
22
name: steadybit-extension-jmeter
33
description: Steadybit jmeter extension Helm chart for Kubernetes.
4-
version: 1.1.10
4+
version: 1.1.11
55
appVersion: v1.0.16
66
home: https://www.steadybit.com/
77
icon: https://steadybit-website-assets.s3.amazonaws.com/logo-symbol-transparent.png

‎charts/steadybit-extension-jmeter/templates/deployment.yaml

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -108,15 +108,10 @@ spec:
108108
httpGet:
109109
path: /health/readiness
110110
port: 8088
111+
{{- with .Values.containerSecurityContext }}
111112
securityContext:
112-
readOnlyRootFilesystem: true
113-
runAsNonRoot: true
114-
runAsUser: 10000
115-
runAsGroup: 10000
116-
allowPrivilegeEscalation: false
117-
capabilities:
118-
drop:
119-
- ALL
113+
{{- toYaml . | nindent 12 }}
114+
{{- end }}
120115
volumes:
121116
- name: tmp-dir
122117
emptyDir: { }

‎charts/steadybit-extension-jmeter/tests/__snapshot__/deployment_test.yaml.snap

Lines changed: 47 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -78,12 +78,13 @@ manifest should match snapshot using podAnnotations and Labels:
7878
drop:
7979
- ALL
8080
readOnlyRootFilesystem: true
81-
runAsGroup: 10000
82-
runAsNonRoot: true
83-
runAsUser: 10000
8481
volumeMounts:
8582
- mountPath: /tmp
8683
name: tmp-dir
84+
securityContext:
85+
runAsNonRoot: true
86+
seccompProfile:
87+
type: RuntimeDefault
8788
serviceAccountName: steadybit-extension-jmeter
8889
volumes:
8990
- emptyDir: {}
@@ -170,15 +171,16 @@ manifest should match snapshot with TLS:
170171
drop:
171172
- ALL
172173
readOnlyRootFilesystem: true
173-
runAsGroup: 10000
174-
runAsNonRoot: true
175-
runAsUser: 10000
176174
volumeMounts:
177175
- mountPath: /tmp
178176
name: tmp-dir
179177
- mountPath: /etc/extension/certificates/server-cert
180178
name: certificate-server-cert
181179
readOnly: true
180+
securityContext:
181+
runAsNonRoot: true
182+
seccompProfile:
183+
type: RuntimeDefault
182184
serviceAccountName: steadybit-extension-jmeter
183185
volumes:
184186
- emptyDir: {}
@@ -272,12 +274,13 @@ manifest should match snapshot with extra env vars:
272274
drop:
273275
- ALL
274276
readOnlyRootFilesystem: true
275-
runAsGroup: 10000
276-
runAsNonRoot: true
277-
runAsUser: 10000
278277
volumeMounts:
279278
- mountPath: /tmp
280279
name: tmp-dir
280+
securityContext:
281+
runAsNonRoot: true
282+
seccompProfile:
283+
type: RuntimeDefault
281284
serviceAccountName: steadybit-extension-jmeter
282285
volumes:
283286
- emptyDir: {}
@@ -362,12 +365,13 @@ manifest should match snapshot with extra labels:
362365
drop:
363366
- ALL
364367
readOnlyRootFilesystem: true
365-
runAsGroup: 10000
366-
runAsNonRoot: true
367-
runAsUser: 10000
368368
volumeMounts:
369369
- mountPath: /tmp
370370
name: tmp-dir
371+
securityContext:
372+
runAsNonRoot: true
373+
seccompProfile:
374+
type: RuntimeDefault
371375
serviceAccountName: steadybit-extension-jmeter
372376
volumes:
373377
- emptyDir: {}
@@ -456,9 +460,6 @@ manifest should match snapshot with mutual TLS:
456460
drop:
457461
- ALL
458462
readOnlyRootFilesystem: true
459-
runAsGroup: 10000
460-
runAsNonRoot: true
461-
runAsUser: 10000
462463
volumeMounts:
463464
- mountPath: /tmp
464465
name: tmp-dir
@@ -468,6 +469,10 @@ manifest should match snapshot with mutual TLS:
468469
- mountPath: /etc/extension/certificates/server-cert
469470
name: certificate-server-cert
470471
readOnly: true
472+
securityContext:
473+
runAsNonRoot: true
474+
seccompProfile:
475+
type: RuntimeDefault
471476
serviceAccountName: steadybit-extension-jmeter
472477
volumes:
473478
- emptyDir: {}
@@ -564,12 +569,13 @@ manifest should match snapshot with mutual TLS using containerPaths:
564569
drop:
565570
- ALL
566571
readOnlyRootFilesystem: true
567-
runAsGroup: 10000
568-
runAsNonRoot: true
569-
runAsUser: 10000
570572
volumeMounts:
571573
- mountPath: /tmp
572574
name: tmp-dir
575+
securityContext:
576+
runAsNonRoot: true
577+
seccompProfile:
578+
type: RuntimeDefault
573579
serviceAccountName: steadybit-extension-jmeter
574580
volumes:
575581
- emptyDir: {}
@@ -652,14 +658,14 @@ manifest should match snapshot with podSecurityContext:
652658
drop:
653659
- ALL
654660
readOnlyRootFilesystem: true
655-
runAsGroup: 10000
656-
runAsNonRoot: true
657-
runAsUser: 10000
658661
volumeMounts:
659662
- mountPath: /tmp
660663
name: tmp-dir
661664
securityContext:
665+
runAsNonRoot: true
662666
runAsUser: 2222
667+
seccompProfile:
668+
type: RuntimeDefault
663669
serviceAccountName: steadybit-extension-jmeter
664670
volumes:
665671
- emptyDir: {}
@@ -742,13 +748,14 @@ manifest should match snapshot with priority class:
742748
drop:
743749
- ALL
744750
readOnlyRootFilesystem: true
745-
runAsGroup: 10000
746-
runAsNonRoot: true
747-
runAsUser: 10000
748751
volumeMounts:
749752
- mountPath: /tmp
750753
name: tmp-dir
751754
priorityClassName: my-priority-class
755+
securityContext:
756+
runAsNonRoot: true
757+
seccompProfile:
758+
type: RuntimeDefault
752759
serviceAccountName: steadybit-extension-jmeter
753760
volumes:
754761
- emptyDir: {}
@@ -831,12 +838,13 @@ manifest should match snapshot without TLS:
831838
drop:
832839
- ALL
833840
readOnlyRootFilesystem: true
834-
runAsGroup: 10000
835-
runAsNonRoot: true
836-
runAsUser: 10000
837841
volumeMounts:
838842
- mountPath: /tmp
839843
name: tmp-dir
844+
securityContext:
845+
runAsNonRoot: true
846+
seccompProfile:
847+
type: RuntimeDefault
840848
serviceAccountName: steadybit-extension-jmeter
841849
volumes:
842850
- emptyDir: {}
@@ -921,12 +929,13 @@ should add cluster name from global values:
921929
drop:
922930
- ALL
923931
readOnlyRootFilesystem: true
924-
runAsGroup: 10000
925-
runAsNonRoot: true
926-
runAsUser: 10000
927932
volumeMounts:
928933
- mountPath: /tmp
929934
name: tmp-dir
935+
securityContext:
936+
runAsNonRoot: true
937+
seccompProfile:
938+
type: RuntimeDefault
930939
serviceAccountName: steadybit-extension-jmeter
931940
volumes:
932941
- emptyDir: {}
@@ -1011,12 +1020,13 @@ should add cluster name from local values:
10111020
drop:
10121021
- ALL
10131022
readOnlyRootFilesystem: true
1014-
runAsGroup: 10000
1015-
runAsNonRoot: true
1016-
runAsUser: 10000
10171023
volumeMounts:
10181024
- mountPath: /tmp
10191025
name: tmp-dir
1026+
securityContext:
1027+
runAsNonRoot: true
1028+
seccompProfile:
1029+
type: RuntimeDefault
10201030
serviceAccountName: steadybit-extension-jmeter
10211031
volumes:
10221032
- emptyDir: {}
@@ -1101,12 +1111,13 @@ should enable location selection:
11011111
drop:
11021112
- ALL
11031113
readOnlyRootFilesystem: true
1104-
runAsGroup: 10000
1105-
runAsNonRoot: true
1106-
runAsUser: 10000
11071114
volumeMounts:
11081115
- mountPath: /tmp
11091116
name: tmp-dir
1117+
securityContext:
1118+
runAsNonRoot: true
1119+
seccompProfile:
1120+
type: RuntimeDefault
11101121
serviceAccountName: steadybit-extension-jmeter
11111122
volumes:
11121123
- emptyDir: {}

‎charts/steadybit-extension-jmeter/values.yaml

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,18 @@ affinity: {}
107107
priorityClassName: null
108108

109109
# podSecurityContext -- SecurityContext to apply to the pod.
110-
podSecurityContext: {}
110+
podSecurityContext:
111+
seccompProfile:
112+
type: RuntimeDefault
113+
runAsNonRoot: true
114+
115+
# containerSecurityContext -- SecurityContext to apply to the container.
116+
containerSecurityContext:
117+
readOnlyRootFilesystem: true
118+
allowPrivilegeEscalation: false
119+
capabilities:
120+
drop:
121+
- ALL
111122

112123
# extraEnv -- Array with extra environment variables to add to the container
113124
# e.g:

0 commit comments

Comments
 (0)