chore(ci): update security context (#32)

.github/workflows/.deploy.yml

@@ -19,45 +19,45 @@ on:
         type: string
 
 jobs:
-  database:
-    name: Database
-    environment: ${{ inputs.environment }}
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Deploy Database
-        uses: bcgov-nr/[email protected]
-        with:
-          oc_namespace: ${{ vars.OC_NAMESPACE }}
-          oc_server: ${{ vars.OC_SERVER }}
-          oc_token: ${{ secrets.OC_TOKEN }}
-          file: database/openshift.deploy.yml
-          overwrite: false
-          parameters:
-            -p TAG=${{ inputs.tag }} -p TARGET=${{ inputs.target }}
+  # database:
+  #   name: Database
+  #   environment: ${{ inputs.environment }}
+  #   runs-on: ubuntu-22.04
+  #   steps:
+  #     - name: Deploy Database
+  #       uses: bcgov-nr/[email protected]
+  #       with:
+  #         oc_namespace: ${{ vars.OC_NAMESPACE }}
+  #         oc_server: ${{ vars.OC_SERVER }}
+  #         oc_token: ${{ secrets.OC_TOKEN }}
+  #         file: database/openshift.deploy.yml
+  #         overwrite: false
+  #         parameters:
+  #           -p TAG=${{ inputs.tag }} -p TARGET=${{ inputs.target }}
 
-  backend:
-    name: Backend
-    needs: [database]
-    environment: ${{ inputs.environment }}
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Deploy Backend
-        uses: bcgov-nr/[email protected]
-        with:
-          oc_namespace: ${{ vars.OC_NAMESPACE }}
-          oc_server: ${{ vars.OC_SERVER }}
-          oc_token: ${{ secrets.OC_TOKEN }}
-          file: backend/openshift.deploy.yml
-          overwrite: true
-          parameters:
-            -p TAG=${{ inputs.tag }} -p TARGET=${{ inputs.target }}
-          verification_path: /api/health
-          verification_retry_attempts: "5"
-          verification_retry_seconds: "15"
+  # backend:
+  #   name: Backend
+  #   needs: [database]
+  #   environment: ${{ inputs.environment }}
+  #   runs-on: ubuntu-22.04
+  #   steps:
+  #     - name: Deploy Backend
+  #       uses: bcgov-nr/[email protected]
+  #       with:
+  #         oc_namespace: ${{ vars.OC_NAMESPACE }}
+  #         oc_server: ${{ vars.OC_SERVER }}
+  #         oc_token: ${{ secrets.OC_TOKEN }}
+  #         file: backend/openshift.deploy.yml
+  #         overwrite: true
+  #         parameters:
+  #           -p TAG=${{ inputs.tag }} -p TARGET=${{ inputs.target }}
+  #         verification_path: /api/health
+  #         verification_retry_attempts: "5"
+  #         verification_retry_seconds: "15"
 
   frontend:
     name: Frontend
-    needs: [backend]
+    # needs: [backend]
     environment: ${{ inputs.environment }}
     runs-on: ubuntu-22.04
     steps:

.github/workflows/pr-open.yml

@@ -29,7 +29,7 @@ jobs:
   # https://github.com/bcgov/quickstart-openshift-helpers
   deploys:
     name: Deploy
-    needs: [builds]
+    # needs: [builds]
     secrets: inherit
     uses: ./.github/workflows/.deploy.yml
 

frontend/openshift.deploy.yml

@@ -55,8 +55,10 @@ objects:
           containers:
             - name: ${APP}-${TARGET}-${COMPONENT}
               image: ghcr.io/${ORG}/${APP}/${COMPONENT}:${TAG}
-              # securityContext:
-              #   runAsUser: 1011540000
+              # TODO: be more specific when giving permissions
+              securityContext:
+                capabilities:
+                  add: ["NET_BIND_SERVICE"]
               imagePullPolicy: Always
               env:
                 - name: LOG_LEVEL