Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: run as non-root #236

Draft
wants to merge 9 commits into
base: main
Choose a base branch
from
Draft

feat: run as non-root #236

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
20e75ac
feat: run as non-root
ed382 Nov 14, 2024
97761d2
fix: nats pod security context
ed382 Nov 14, 2024
89d344f
fix: security context for api
ed382 Nov 14, 2024
d0b88ec
fix: security context for worker service
ed382 Nov 14, 2024
9c2bd30
fix: dex use/group/fsgroup
ed382 Nov 19, 2024
dedcbd2
fix: mongodb user/group/fsgroup
ed382 Nov 19, 2024
d7824cc
fix: set the security context not globally
ed382 Jan 8, 2025
d3cac53
feat: ui security context
ed382 Jan 8, 2025
21ea859
fix: shared secret generator as restricted
ed382 Jan 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/testkube-enterprise/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ dependencies:
repository: file://../testkube-worker-service
- name: testkube
alias: testkube-agent
version: 2.1.122
version: 2.1.123
repository: https://kubeshop.github.io/helm-charts
condition: testkube-agent.enabled
- name: dex
Expand Down
51 changes: 42 additions & 9 deletions charts/testkube-enterprise/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,16 @@ sharedSecretGenerator:
# -- Toggle whether to enable the Shared Secret Generator Job
enabled: false
# -- Pod Security Context for the Shared Secret Generator Job
securityContext: {}
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
runAsUser: 1001
runAsGroup: 1001
fsGroup: 1001
capabilities:
drop: ["ALL"]
seccompProfile:
type: RuntimeDefault
# -- Container Security Context for the Shared Secret Generator Job
containerSecurityContext: {}
# -- Resources for the Shared Secret Generator Job
Expand Down Expand Up @@ -188,6 +197,7 @@ minio:
affinity: {}
# MinIO Pod Security Context
podSecurityContext:
runAsNonRoot: true
# -- Toggle whether to render the pod security context
enabled: true
fsGroup: 1001
Expand Down Expand Up @@ -250,8 +260,11 @@ testkube-cloud-api:
repository: kubeshop/testkube-migration
tag: 1.11.6
# -- Pod Security Context
podSecurityContext: {}
# fsGroup: 2000
podSecurityContext:
runAsNonRoot: true
runAsUser: 1001
runAsGroup: 1001
fsGroup: 1001
# -- Container Security Context
securityContext:
readOnlyRootFilesystem: true
Expand Down Expand Up @@ -449,8 +462,11 @@ testkube-cloud-ui:
repository: kubeshop/testkube-enterprise-ui
tag: 2.8.3
# -- Pod Security Context
podSecurityContext: {}
# fsGroup: 2000
podSecurityContext:
runAsNonRoot: true
runAsUser: 1001
runAsGroup: 1001
fsGroup: 1001
# -- Container Security Context
securityContext:
readOnlyRootFilesystem: true
Expand Down Expand Up @@ -502,8 +518,11 @@ testkube-worker-service:
repository: kubeshop/testkube-enterprise-worker-service
tag: 1.11.6
# -- Pod Security Context
podSecurityContext: {}
# fsGroup: 2000
podSecurityContext:
runAsNonRoot: true
runAsUser: 1001
runAsGroup: 1001
fsGroup: 1001
# -- Container Security Context
securityContext:
readOnlyRootFilesystem: true
Expand Down Expand Up @@ -531,6 +550,12 @@ nats:
# -- Toggle whether to install NATS
enabled: true
fullnameOverride: testkube-enterprise-nats
# -- NATS Pod Security Context
podSecurityContext:
runAsNonRoot: true
runAsUser: 1001
runAsGroup: 1001
fsGroup: 1001
# Uncomment if you want to provide a different image or pullPolicy
container:
merge:
Expand Down Expand Up @@ -685,7 +710,11 @@ mongodb:
tolerations: []
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
# -- MongoDB Pod Security Context
podSecurityContext: {}
podSecurityContext:
runAsNonRoot: true
runAsUser: 1001
runAsGroup: 1001
fsGroup: 1001
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
# -- Security Context for MongoDB container
containerSecurityContext: {}
Expand Down Expand Up @@ -775,7 +804,11 @@ dex:
securityContext: {}
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
# -- Dex Pod Security Context
podSecurityContext: {}
podSecurityContext:
runAsNonRoot: true
runAsUser: 1001
runAsGroup: 1001
fsGroup: 1001
# -- Set resources requests and limits for Dex Service
resources:
requests:
Expand Down
Loading