panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

spire-server: Replace chown image with busybox

Browse Source 
This reduces the footprint for this initContainer to just 4.04MB.

The cgr.dev/chainguard/bash image is 35.2MB in size.

I have used the same tag as the busybox value to ensure no additional
versions have to be pulled on the node running spire-server components.

Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2025-07-08 23:43:53 +02:00
parent a7d536c025
commit 093c593ff6
4 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+3 -3
View File
@@ -466,10 +466,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` |
| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` |
| `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `chown.image.repository` | The repository within the registry | `chainguard/bash` |
| `chown.image.registry` | The OCI registry to pull the image from | `""` |
| `chown.image.repository` | The repository within the registry | `busybox` |
| `chown.image.pullPolicy` | The image pull policy | `Always` |
| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28c83a645bb2d55d617d9bc8874ac62362b07cc6ad446bdd5c3d53177da21edc` |
| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` |
| `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `experimental.enabled` | Allow configuration of experimental features | `false` |
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
charts/spire/charts/spire-server/templates/server-resource.yaml
+1 -1
View File
@@ -180,7 +180,7 @@ spec:
- name: chown
image: {{ template "spire-lib.image" (dict "image" .Values.chown.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.chown.image.pullPolicy }}
command: ["bash", "-c"]
command: ["sh", "-c"]
args:
- |
chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.runAsGroup }} /var/lib/spire
charts/spire/charts/spire-server/values.yaml
+3 -3
View File
@@ -1191,10 +1191,10 @@ chown:
## @param chown.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
registry: cgr.dev
repository: chainguard/bash
registry: ""
repository: busybox
pullPolicy: Always
tag: latest@sha256:28c83a645bb2d55d617d9bc8874ac62362b07cc6ad446bdd5c3d53177da21edc
tag: 1.37.0-uclibc
## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {}