Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[jfrog-platform] Added podSecurityContext and containerSecurityContext for pre-upgrade-check migration hook container #1929

Merged
merged 1 commit into from
Oct 23, 2024

Conversation

mrarends
Copy link
Contributor

PR Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

  • Chart Version bumped
  • CHANGELOG.md updated
  • Variables and other changes are documented in the README.md
  • Title of the PR starts with chart name (e.g. [artifactory])

What this PR does / why we need it:
The new pre-upgrade-check pod and container is missing the option to set security context settings. On clusters that require more strict settings the pre-upgrade-check can not be started:

violates PodSecurity'

	(combined from similar events): Error creating: pods "jfrog-platform-pre-upgrade-check-j527c" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "pre-upgrade-check" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "pre-upgrade-check" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "pre-upgrade-check" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "pre-upgrade-check" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

Special notes for your reviewer:

@oumkale oumkale self-requested a review October 15, 2024 05:52
@@ -103,6 +103,10 @@ rabbitmq:
image:
repository: bitnami/rabbitmq
tag: 3.12.10-debian-11-r1
podSecurityContext:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems like these changes are specific to you; we are ignoring them

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had to add this because otherwise 'helm lint' gives errors about unknown variables.

@@ -242,6 +246,11 @@ artifactory:
url: '{{ include "database.url" . }}'
user: artifactory
password: artifactory
ingress:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems like these changes are specific to you; we are ignoring them

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had to add this because otherwise 'helm lint' gives errors about unknown variables.

@oumkale
Copy link
Member

oumkale commented Oct 17, 2024

HI @mrarends,

Thank you so much for your efforts 🥳🥳. We will review this internally and update you once the release is out.

@chukka chukka changed the base branch from master to jp-10.20.0 October 21, 2024 07:50
@chukka chukka changed the base branch from jp-10.20.0 to master October 21, 2024 14:49
@amithins amithins changed the base branch from master to jp-10.19.7 October 23, 2024 12:48
@amithins amithins merged commit 4df8279 into jfrog:jp-10.19.7 Oct 23, 2024
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants