panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix permission issue with 1.10 and defaults when upgraded (#423)

Browse Source 
* Fix permission issue with 1.10 and defaults when upgraded

Signed-off-by: Kevin Fox <[email protected]>

* Fix indenting

Signed-off-by: Kevin Fox <[email protected]>

* incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2024-08-13 22:21:20 -07:00
committed by GitHub
parent 827a3ea80c
commit 9b2d72f6a2
5 changed files with 62 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/templates/_helpers.tpl
+14
View File
@@ -318,3 +318,17 @@ subjects:
namespace: {{ include "spire-server.namespace" . }}
{{- end }}
{{- end }}
{{- define "spire-server.podSecurityContext" -}}
{{- $podSecurityContext := include "spire-lib.podsecuritycontext" . | fromYaml }}
{{- $openshift := ((.Values).global).openshift | default false }}
{{- if not $openshift }}
{{- if not (hasKey $podSecurityContext "runAsUser") }}
{{- $_ := set $podSecurityContext "runAsUser" 1000 }}
{{- end }}
{{- if not (hasKey $podSecurityContext "runAsGroup") }}
{{- $_ := set $podSecurityContext "runAsGroup" 1000 }}
{{- end }}
{{- end }}
{{- toYaml $podSecurityContext }}
{{- end }}
charts/spire/charts/spire-server/templates/server-resource.yaml
+22 -2
View File
@@ -1,3 +1,6 @@
{{- $rawPodSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }}
{{- $podSecurityContext := fromYaml (include "spire-server.podSecurityContext" .) }}
{{- $needsChown := and (not (hasKey $rawPodSecurityContext "runAsUser")) (not (dig "openshift" false .Values.global)) }}
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
{{- $configSum2 := (include (print $.Template.BasePath "/secret.yaml") . | sha256sum) }}
{{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
@@ -76,9 +79,9 @@ spec:
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}
shareProcessNamespace: true
securityContext:
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
{{- $podSecurityContext | toYaml | nindent 8 }}
{{- include "spire-lib.default_cluster_priority_class_name" . | nindent 6 }}
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) .Values.nodeAttestor.tpmDirect.enabled }}
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) .Values.nodeAttestor.tpmDirect.enabled $needsChown }}
initContainers:
{{- if .Values.nodeAttestor.tpmDirect.enabled }}
- name: init-tpm-direct
@@ -100,6 +103,23 @@ spec:
mountPath: /run/spire/data
imagePullPolicy: {{ .Values.nodeAttestor.tpmDirect.image.pullPolicy }}
{{- end }}
{{- if $needsChown }}
- name: chown
image: {{ template "spire-lib.image" (dict "image" .Values.chown.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.chown.image.pullPolicy }}
command: ["bash", "-c"]
args:
- |
chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.runAsGroup }} /var/lib/spire
resources:
{{- toYaml .Values.chown.resources | nindent 12 }}
volumeMounts:
- name: spire-data
mountPath: /var/lib/spire
securityContext:
runAsUser: 0
runAsGroup: 0
{{- end }}
{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }}
- name: wait
securityContext: