panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Protects SPIRE Agent's Chart Against YAML Template Injection (#450)

Browse Source 
* protects agent's chart against template injection

Signed-off-by: Nico Weisenauer <[email protected]>

* removes unnecessary braces and whitespace

Signed-off-by: Nico Weisenauer <[email protected]>

* Removes int type validation via cast

Signed-off-by: Nico Weisenauer <[email protected]>

---------

Signed-off-by: Nico Weisenauer <[email protected]>
This commit is contained in:
nweisenauer
2024-09-16 06:23:01 -07:00
committed by GitHub
parent ea710023f4
commit 8832da39b4
8 changed files with 61 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-lib/templates/_helpers.tpl
+6 -6
View File
@@ -53,17 +53,17 @@
{{- $repo := .image.repository }}
{{- $tag := .image.tag | toString }}
{{- if eq (substr 0 7 $tag) "sha256:" }}
{{- printf "%s/%s@%s" $registry $repo $tag }}
{{- printf "%s/%s@%s" $registry $repo $tag | quote }}
{{- else if .appVersion }}
{{- $appVersion := .appVersion }}
{{- if and (hasKey . "ubi") (dig "openshift" false .global) }}
{{- $appVersion = printf "ubi-%s" $appVersion }}
{{- end }}
{{- printf "%s%s:%s" $registry $repo (default $appVersion $tag) }}
{{- printf "%s%s:%s" $registry $repo (default $appVersion $tag) | quote }}
{{- else if $tag }}
{{- printf "%s%s:%s" $registry $repo $tag }}
{{- printf "%s%s:%s" $registry $repo $tag | quote }}
{{- else }}
{{- printf "%s%s" $registry $repo }}
{{- printf "%s%s" $registry $repo | quote }}
{{- end }}
{{- end }}
@@ -309,7 +309,7 @@ securityContext - the subbranch of values that contains the securityContext to m
{{- define "spire-lib.default_node_priority_class_name" }}
{{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName | quote }}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "priorityClassName" true .Values.global) }}
priorityClassName: system-node-critical
{{- end }}
@@ -317,7 +317,7 @@ priorityClassName: system-node-critical
{{- define "spire-lib.default_cluster_priority_class_name" }}
{{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName | quote }}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "priorityClassName" true .Values.global) }}
priorityClassName: system-cluster-critical
{{- end }}