panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

spire-server: Replace chown image with busybox

Browse Source 
This reduces the footprint for this initContainer to just 4.04MB.

The cgr.dev/chainguard/bash image is 35.2MB in size.

I have used the same tag as the busybox value to ensure no additional
versions have to be pulled on the node running spire-server components.

Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2025-07-08 23:43:53 +02:00
parent a7d536c025
commit 093c593ff6
4 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/images.json
+2 -2
View File
@@ -7,8 +7,8 @@
}, },
{ {
"query": "chown.image", "query": "chown.image",
"filter": "LATESTSHA", "filter": "^[0-9]\\+\\.[0-9]\\+\\.[0-9]\\+-uclibc$",
"sort-flags": [] "sort-flags": ["-t", ".", "-k1,1n", "-k2,2n", "-k3,3n"]
}, },
{ {
"query": "tools.busybox.image", "query": "tools.busybox.image",
charts/spire/charts/spire-server/README.md
+3 -3
View File
@@ -466,10 +466,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | | `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` | | `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` |
| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` | | `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` |
| `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `chown.image.registry` | The OCI registry to pull the image from | `""` |
| `chown.image.repository` | The repository within the registry | `chainguard/bash` | | `chown.image.repository` | The repository within the registry | `busybox` |
| `chown.image.pullPolicy` | The image pull policy | `Always` | | `chown.image.pullPolicy` | The image pull policy | `Always` |
| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:28c83a645bb2d55d617d9bc8874ac62362b07cc6ad446bdd5c3d53177da21edc` | | `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` |
| `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `experimental.enabled` | Allow configuration of experimental features | `false` | | `experimental.enabled` | Allow configuration of experimental features | `false` |
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | | `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
charts/spire/charts/spire-server/templates/server-resource.yaml
+1 -1
View File
@@ -180,7 +180,7 @@ spec:
- name: chown - name: chown
image: {{ template "spire-lib.image" (dict "image" .Values.chown.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.chown.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.chown.image.pullPolicy }} imagePullPolicy: {{ .Values.chown.image.pullPolicy }}
command: ["bash", "-c"] command: ["sh", "-c"]
args: args:
- | - |
chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.runAsGroup }} /var/lib/spire chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.runAsGroup }} /var/lib/spire
charts/spire/charts/spire-server/values.yaml
+3 -3
View File
@@ -1191,10 +1191,10 @@ chown:
## @param chown.image.tag Overrides the image tag whose default is the chart appVersion ## @param chown.image.tag Overrides the image tag whose default is the chart appVersion
## ##
image: image:
registry: cgr.dev registry: ""
repository: chainguard/bash repository: busybox
pullPolicy: Always pullPolicy: Always
tag: latest@sha256:28c83a645bb2d55d617d9bc8874ac62362b07cc6ad446bdd5c3d53177da21edc tag: 1.37.0-uclibc
## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {} resources: {}