chore(seeding): add securityContext to initContainers (#203)

#86
eclipse-tractusx · Oct 14, 2024 · 0775945 · 0775945
1 parent 19eca8e
commit 0775945
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 2 deletions.
diff --git a/charts/centralidp/templates/job-seeding.yaml b/charts/centralidp/templates/job-seeding.yaml
@@ -226,6 +226,13 @@ spec:
             mountPath: "app/realms"
       initContainers:
         - name: init-cx-central
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
           image: {{ .Values.realmSeeding.initContainer.image.name }}
           imagePullPolicy: {{ .Values.realmSeeding.initContainer.image.pullPolicy }}
           command:
@@ -239,7 +246,15 @@ spec:
           - name: realms
             mountPath: "app/realms"
         - name: wait-for-keycloak
-          image: appropriate/curl:latest
+          image: alpine/curl:latest
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 3000
           {{ if .Values.realmSeeding.keycloakServiceTls -}}
           command: [ 'sh', '-c', 'until curl -s https://{{ template "centralidp.fullname" . }}:{{ .Values.realmSeeding.keycloakServicePort }}/auth/realms/master/.well-known/openid-configuration; do echo waiting for other pod; sleep 2; done;' ]
           {{- else -}}

diff --git a/charts/sharedidp/templates/job-seeding.yaml b/charts/sharedidp/templates/job-seeding.yaml
@@ -192,6 +192,13 @@ spec:
             mountPath: "app/realms"
       initContainers:
         - name: init-cx-central
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
           image: {{ .Values.realmSeeding.initContainer.image.name }}
           imagePullPolicy: {{ .Values.realmSeeding.initContainer.image.pullPolicy }}
           command:
@@ -205,7 +212,15 @@ spec:
           - name: realms
             mountPath: "app/realms"
         - name: wait-for-keycloak
-          image: appropriate/curl:latest
+          image: alpine/curl:latest
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 3000
           {{ if .Values.realmSeeding.keycloakServiceTls -}}
           command: [ 'sh', '-c', 'until curl -s https://{{ template "sharedidp.fullname" . }}:{{ .Values.realmSeeding.keycloakServicePort }}/auth/realms/master/.well-known/openid-configuration; do echo waiting for other pod; sleep 2; done;' ]
           {{- else -}}