feat: k8s securityContext, resource limits

charts/semgr8s/templates/deployment.yaml

@@ -23,12 +23,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.deployment.podSecurityContext }}
       securityContext:
-        {{- toYaml .Values.deployment.podSecurityContext | nindent 8 }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}
+          {{- with .Values.deployment.securityContext }}
           securityContext:
-            {{- toYaml .Values.deployment.securityContext | nindent 12 }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           image: "{{ .Values.deployment.image.repository }}:{{ .Values.deployment.image.tag | default (print "v" .Chart.AppVersion) }}"
           imagePullPolicy: {{ .Values.deployment.image.pullPolicy }}
           ports:
@@ -46,6 +50,9 @@ spec:
           - mountPath: /.cache
             name: cache
             readOnly: false
+          - mountPath: /tmp
+            name: tmp
+            readOnly: false
           - mountPath: /app/rules
             name: rules
             readOnly: false
@@ -63,6 +70,10 @@ spec:
         emptyDir: {}
       - name: cache
         emptyDir: {}
+      - name: tmp
+        emptyDir:
+          medium: "Memory"
+          sizeLimit: 10Mi
       - name: rules
         emptyDir: {}
       - name: data

charts/semgr8s/values.yaml

@@ -1,14 +1,32 @@
 deployment:
-  replicaCount: 1
   image:
     repository: ghcr.io/sse-secure-systems/semgr8s
     pullPolicy: IfNotPresent
     tag: ""
-  containerPort: 5000
   imagePullSecrets: []
+  replicaCount: 1
+  containerPort: 5000
   podAnnotations: {}
   podSecurityContext: {}
-  securityContext: {}
+  resources:
+    limits:
+      cpu: 1000m
+      memory: 128Mi
+    requests:
+      cpu: 100m
+      memory: 64Mi
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    privileged: false
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 10001 # remove when using openshift or OKD 4
+    runAsGroup: 20001 # remove when using openshift or OKD 4
+    seccompProfile:
+      type: RuntimeDefault
 
 service:
   type: ClusterIP