chore: update securityContext

.github/workflows/sdfactorypipeline.yml

@@ -1,6 +1,6 @@
 #################################################################################
-# Copyright (c) 2022,2023 T-Systems International GmbH
-# Copyright (c) 2022,2023 Contributors to the Eclipse Foundation
+# Copyright (c) 2022,2024 T-Systems International GmbH
+# Copyright (c) 2022,2024 Contributors to the Eclipse Foundation
 #
 # See the NOTICE file(s) distributed with this work for additional
 # information regarding copyright ownership.
@@ -51,6 +51,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
       # Create SemVer or ref tags dependent of trigger event
       - name: Docker meta
@@ -80,6 +84,7 @@ jobs:
         uses: docker/build-push-action@v3
         with:
           context: .
+          platforms: linux/amd64,linux/arm64
           # Build image for verification purposes on every trigger event. Only push if event is not a PR
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}

CHANGELOG.md

@@ -7,7 +7,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 ## [Unreleased]
 ### Changed
 - Updated Spring Boot and its transitive dependencies
-
+- Provided multi-arch image of sdfactory
+- Updated default imagePullPolicy
+- Updated probes in values file so that it can be configurable
+- Updated security context
 
 ## [2.1.9] - 2024-01-30
 

charts/sdfactory/templates/deployment.yaml

@@ -1,6 +1,6 @@
 #################################################################################
-# Copyright (c) 2022,2023 T-Systems International GmbH
-# Copyright (c) 2022,2023 Contributors to the Eclipse Foundation
+# Copyright (c) 2022,2024 T-Systems International GmbH
+# Copyright (c) 2022,2024 Contributors to the Eclipse Foundation
 #
 # See the NOTICE file(s) distributed with this work for additional
 # information regarding copyright ownership.
@@ -117,13 +117,13 @@ spec:
           readinessProbe:
             tcpSocket:
               port: {{ .Values.service.targetPort }}
-            initialDelaySeconds: 10
-            periodSeconds: 10
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
           livenessProbe:
             tcpSocket:
               port: {{ .Values.service.targetPort }}
-            initialDelaySeconds: 10
-            periodSeconds: 10
+            initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
 
           resources:
             {{- toYaml .Values.resources | nindent 12 }}

charts/sdfactory/values.yaml

@@ -1,6 +1,6 @@
 #################################################################################
-# Copyright (c) 2022,2023 T-Systems International GmbH
-# Copyright (c) 2022,2023 Contributors to the Eclipse Foundation
+# Copyright (c) 2022,2024 T-Systems International GmbH
+# Copyright (c) 2022,2024 Contributors to the Eclipse Foundation
 #
 # See the NOTICE file(s) distributed with this work for additional
 # information regarding copyright ownership.
@@ -25,12 +25,11 @@
     # -- Number of Replicas for pods
 replicaCount: 1
 
-
 image:
     # -- Image to use for deploying an application
   repository: "tractusx/sdfactory"
     # -- Set the Image Pull Policy
-  pullPolicy: Always
+  pullPolicy: IfNotPresent
     # -- Image tage is defined in chart appVersion.
   tag: ""
 
@@ -49,19 +48,18 @@ serviceAccount:
 
 podAnnotations: {}
 
-
 podSecurityContext:
   fsGroup: 2000
 
 securityContext:
-    # -- Controls whether a process can gain more privileges
+  capabilities:
+    drop:
+      - ALL
   allowPrivilegeEscalation: false
-  # capabilities:
-  #   drop:
-  #   - ALL
   # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  runAsUser: 1000
+  runAsNonRoot: true
+  runAsUser: 1001
+  runAsGroup: 3000
 
 sdfactory:
   secret:
@@ -90,7 +88,6 @@ sdfactory:
     # -- Details for Clearing House Client Secret
     clearingHouseClientSecret: ""
 
-
 service:
     # -- Type of service
   type: ClusterIP
@@ -129,6 +126,13 @@ resources:
     # -- set a minimum amount of allows memory utilization by specifying a limit on the container.
     memory: 700Mi
 
+readinessProbe:
+  initialDelaySeconds: 10
+  periodSeconds: 10
+livenessProbe:
+  initialDelaySeconds: 10
+  periodSeconds: 10
+
 autoscaling:
   enabled: false
   minReplicas: 1