Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: Mount Chart container's root file systems as read-only #732

Merged
merged 1 commit into from
Feb 1, 2024
Merged

Fix: Mount Chart container's root file systems as read-only #732

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions charts/bpdm/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,11 @@ The format is based on Keep a Changelog (https://keepachangelog.com/en/1.0.0/),
### Changed

- update application version to 5.0.0
- update BPDM Pool Chart to version 6.0.0
- update BPDM Gate Chart to version 5.0.0
- update BPDM Orchestrator Chart to version 2.0.0
- update BPDM Cleaning Service Dummy Chart to version 2.0.0
- update BPDM Bridge Chart to version 2.0.0

## [3.1.2] - 2023-11-16

Expand Down
12 changes: 6 additions & 6 deletions charts/bpdm/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ apiVersion: v2
name: bpdm
type: application
description: A Helm chart for Kubernetes that deploys the BPDM applications
version: 4.0.0-alpha.5
version: 4.0.0-alpha.6
appVersion: "5.0.0-alpha.5"
home: https://github.com/eclipse-tractusx/bpdm
sources:
Expand All @@ -33,23 +33,23 @@ maintainers:

dependencies:
- name: bpdm-gate
version: 5.0.0-alpha.5
version: 5.0.0-alpha.6
alias: bpdm-gate
condition: bpdm-gate.enabled
- name: bpdm-pool
version: 6.0.0-alpha.5
version: 6.0.0-alpha.6
alias: bpdm-pool
condition: bpdm-pool.enabled
- name: bpdm-bridge-dummy
version: 2.0.0-alpha.5
version: 2.0.0-alpha.6
alias: bpdm-bridge-dummy
condition: bpdm-bridge-dummy.enabled
- name: bpdm-cleaning-service-dummy
version: 2.0.0-alpha.5
version: 2.0.0-alpha.6
alias: bpdm-cleaning-service-dummy
condition: bpdm-cleaning-service-dummy.enabled
- name: bpdm-orchestrator
version: 2.0.0-alpha.5
version: 2.0.0-alpha.6
alias: bpdm-orchestrator
condition: bpdm-orchestrator.enabled
- name: postgresql
Expand Down
1 change: 1 addition & 0 deletions charts/bpdm/charts/bpdm-bridge-dummy/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ The format is based on Keep a Changelog (https://keepachangelog.com/en/1.0.0/),

- update application version to 5.0.0
- increase container's default groupid to 10001
- container is now executed with read-only root file systems

## [1.1.0] - 2023-11-03

Expand Down
2 changes: 1 addition & 1 deletion charts/bpdm/charts/bpdm-bridge-dummy/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ apiVersion: v2
type: application
name: bpdm-bridge-dummy
appVersion: "5.0.0-alpha.5"
version: 2.0.0-alpha.5
version: 2.0.0-alpha.6
description: A Helm chart for deploying the BPDM bridge dummy service
home: https://eclipse-tractusx.github.io/docs/kits/Business%20Partner%20Kit/Adoption%20View
sources:
Expand Down
7 changes: 6 additions & 1 deletion charts/bpdm/charts/bpdm-bridge-dummy/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,8 @@ spec:
- mountPath: /etc/conf
name: config
readOnly: true
- mountPath: /tmp
name: cache
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
Expand All @@ -100,4 +102,7 @@ spec:
- configMap:
name: {{ include "bpdm.fullname" . }}
- secret:
name: {{ include "bpdm.fullname" . }}
name: {{ include "bpdm.fullname" . }}
- name: cache
emptyDir:
sizeLimit: 200Mi
1 change: 1 addition & 0 deletions charts/bpdm/charts/bpdm-bridge-dummy/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ springProfiles: []
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: true
runAsUser: 10001
runAsGroup: 10001
capabilities:
Expand Down
1 change: 1 addition & 0 deletions charts/bpdm/charts/bpdm-cleaning-service-dummy/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ The format is based on Keep a Changelog (https://keepachangelog.com/en/1.0.0/),

- Update application version to 5.0.0
- increase container's default groupid to 10001
- container is now executed with read-only root file systems

## [1.0.2] - 2023-11-23

Expand Down
2 changes: 1 addition & 1 deletion charts/bpdm/charts/bpdm-cleaning-service-dummy/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ apiVersion: v2
type: application
name: bpdm-cleaning-service-dummy
appVersion: "5.0.0-alpha.5"
version: 2.0.0-alpha.5
version: 2.0.0-alpha.6
description: A Helm chart for deploying the BPDM cleaning service
home: https://eclipse-tractusx.github.io/docs/kits/Business%20Partner%20Kit/Adoption%20View
sources:
Expand Down
7 changes: 6 additions & 1 deletion charts/bpdm/charts/bpdm-cleaning-service-dummy/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,8 @@ spec:
- mountPath: /etc/conf
name: config
readOnly: true
- mountPath: /tmp
name: cache
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
Expand All @@ -95,4 +97,7 @@ spec:
- configMap:
name: {{ include "bpdm.fullname" . }}
- secret:
name: {{ include "bpdm.fullname" . }}
name: {{ include "bpdm.fullname" . }}
- name: cache
emptyDir:
sizeLimit: 200Mi
1 change: 1 addition & 0 deletions charts/bpdm/charts/bpdm-cleaning-service-dummy/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ securityContext:
type: RuntimeDefault
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: true
runAsUser: 10001
runAsGroup: 10001
capabilities:
Expand Down
1 change: 1 addition & 0 deletions charts/bpdm/charts/bpdm-gate/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ The format is based on Keep a Changelog (https://keepachangelog.com/en/1.0.0/),

- Update application version to 5.0.0
- increase container's default groupid to 10001
- container is now executed with read-only root file systems

## [4.1.0] - 2023-11-03

Expand Down
2 changes: 1 addition & 1 deletion charts/bpdm/charts/bpdm-gate/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ apiVersion: v2
type: application
name: bpdm-gate
appVersion: "5.0.0-alpha.5"
version: 5.0.0-alpha.5
version: 5.0.0-alpha.6
description: A Helm chart for deploying the BPDM gate service
home: https://eclipse-tractusx.github.io/docs/kits/Business%20Partner%20Kit/Adoption%20View
sources:
Expand Down
7 changes: 6 additions & 1 deletion charts/bpdm/charts/bpdm-gate/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,8 @@ spec:
- mountPath: /etc/conf
name: config
readOnly: true
- mountPath: /tmp
name: cache
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
Expand All @@ -100,4 +102,7 @@ spec:
- configMap:
name: {{ include "bpdm.fullname" . }}
- secret:
name: {{ include "bpdm.fullname" . }}
name: {{ include "bpdm.fullname" . }}
- name: cache
emptyDir:
sizeLimit: 200Mi
1 change: 1 addition & 0 deletions charts/bpdm/charts/bpdm-gate/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ springProfiles: []
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: true
runAsUser: 10001
runAsGroup: 10001
capabilities:
Expand Down
1 change: 1 addition & 0 deletions charts/bpdm/charts/bpdm-orchestrator/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ The format is based on Keep a Changelog (https://keepachangelog.com/en/1.0.0/),

- Update application version to 5.0.0
- increase container's default groupid to 10001
- container is now executed with read-only root file systems

## [1.0.1] - 2023-11-23

Expand Down
2 changes: 1 addition & 1 deletion charts/bpdm/charts/bpdm-orchestrator/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ apiVersion: v2
type: application
name: bpdm-orchestrator
appVersion: "5.0.0-alpha.5"
version: 2.0.0-alpha.5
version: 2.0.0-alpha.6
description: A Helm chart for deploying the BPDM Orchestrator service
home: https://eclipse-tractusx.github.io/docs/kits/Business%20Partner%20Kit/Adoption%20View
sources:
Expand Down
7 changes: 6 additions & 1 deletion charts/bpdm/charts/bpdm-orchestrator/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,8 @@ spec:
- mountPath: /etc/conf
name: config
readOnly: true
- mountPath: /tmp
name: cache
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
Expand All @@ -95,4 +97,7 @@ spec:
- configMap:
name: {{ include "bpdm.fullname" . }}
- secret:
name: {{ include "bpdm.fullname" . }}
name: {{ include "bpdm.fullname" . }}
- name: cache
emptyDir:
sizeLimit: 200Mi
1 change: 1 addition & 0 deletions charts/bpdm/charts/bpdm-orchestrator/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ securityContext:
type: RuntimeDefault
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: true
runAsUser: 10001
runAsGroup: 10001
capabilities:
Expand Down
1 change: 1 addition & 0 deletions charts/bpdm/charts/bpdm-pool/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ The format is based on Keep a Changelog (https://keepachangelog.com/en/1.0.0/),

- Update application version to 5.0.0
- increase container's default groupid to 10001
- container is now executed with read-only root file systems

## [5.1.1] - 2023-11-16

Expand Down
2 changes: 1 addition & 1 deletion charts/bpdm/charts/bpdm-pool/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ apiVersion: v2
type: application
name: bpdm-pool
appVersion: "5.0.0-alpha.5"
version: 6.0.0-alpha.5
version: 6.0.0-alpha.6
description: A Helm chart for deploying the BPDM pool service
home: https://eclipse-tractusx.github.io/docs/kits/Business%20Partner%20Kit/Adoption%20View
sources:
Expand Down
5 changes: 5 additions & 0 deletions charts/bpdm/charts/bpdm-pool/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,8 @@ spec:
- mountPath: /etc/conf
name: config
readOnly: true
- mountPath: /tmp
name: cache
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
Expand All @@ -100,3 +102,6 @@ spec:
name: {{ include "bpdm.fullname" . }}
- secret:
name: {{ include "bpdm.fullname" . }}
- name: cache
emptyDir:
sizeLimit: 200Mi
1 change: 1 addition & 0 deletions charts/bpdm/charts/bpdm-pool/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ springProfiles: []
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: true
runAsUser: 10001
runAsGroup: 10001
capabilities:
Expand Down
Loading