run as user 1001 by default
Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>
This commit is contained in:
Pascal Sthamer
@@ -184,8 +184,8 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
|
||||
| `backend.podSecurityContext.fsGroup` | Set fsGroup in backend pods' Security Context | `1001` |
|
||||
| `backend.containerSecurityContext.enabled` | Enabled backend container' Security Context | `true` |
|
||||
| `backend.containerSecurityContext.seLinuxOptions` | Set SELinux options in backend container | `{}` |
|
||||
| `backend.containerSecurityContext.runAsUser` | Set runAsUser in backend container' Security Context | `1000` |
|
||||
| `backend.containerSecurityContext.runAsGroup` | Set runAsGroup in backend container' Security Context | `1000` |
|
||||
| `backend.containerSecurityContext.runAsUser` | Set runAsUser in backend container' Security Context | `1001` |
|
||||
| `backend.containerSecurityContext.runAsGroup` | Set runAsGroup in backend container' Security Context | `1001` |
|
||||
| `backend.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in backend container' Security Context | `true` |
|
||||
| `backend.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in backend container' Security Context | `true` |
|
||||
| `backend.containerSecurityContext.privileged` | Set privileged in backend container' Security Context | `false` |
|
||||
@@ -302,8 +302,8 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
|
||||
| `frontend.podSecurityContext.fsGroup` | Set fsGroup in frontend pods' Security Context | `1001` |
|
||||
| `frontend.containerSecurityContext.enabled` | Enabled frontend container' Security Context | `false` |
|
||||
| `frontend.containerSecurityContext.seLinuxOptions` | Set SELinux options in frontend container | `{}` |
|
||||
| `frontend.containerSecurityContext.runAsUser` | Set runAsUser in frontend container' Security Context | `101` |
|
||||
| `frontend.containerSecurityContext.runAsGroup` | Set runAsGroup in frontend container' Security Context | `101` |
|
||||
| `frontend.containerSecurityContext.runAsUser` | Set runAsUser in frontend container' Security Context | `1001` |
|
||||
| `frontend.containerSecurityContext.runAsGroup` | Set runAsGroup in frontend container' Security Context | `1001` |
|
||||
| `frontend.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in frontend container' Security Context | `true` |
|
||||
| `frontend.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in frontend container' Security Context | `true` |
|
||||
| `frontend.containerSecurityContext.privileged` | Set privileged in frontend container' Security Context | `false` |
|
||||
@@ -409,8 +409,8 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
|
||||
| `orborus.podSecurityContext.fsGroup` | Set fsGroup in orborus pods' Security Context | `1001` |
|
||||
| `orborus.containerSecurityContext.enabled` | Enabled orborus container' Security Context | `true` |
|
||||
| `orborus.containerSecurityContext.seLinuxOptions` | Set SELinux options in orborus container | `{}` |
|
||||
| `orborus.containerSecurityContext.runAsUser` | Set runAsUser in orborus container' Security Context | `101` |
|
||||
| `orborus.containerSecurityContext.runAsGroup` | Set runAsGroup in orborus container' Security Context | `101` |
|
||||
| `orborus.containerSecurityContext.runAsUser` | Set runAsUser in orborus container' Security Context | `1001` |
|
||||
| `orborus.containerSecurityContext.runAsGroup` | Set runAsGroup in orborus container' Security Context | `1001` |
|
||||
| `orborus.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in orborus container' Security Context | `true` |
|
||||
| `orborus.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in orborus container' Security Context | `true` |
|
||||
| `orborus.containerSecurityContext.privileged` | Set privileged in orborus container' Security Context | `false` |
|
||||
@@ -605,3 +605,4 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier"
|
||||
|
||||
### Other Parameters
|
||||
|
||||
|
||||
|
||||
@@ -367,12 +367,12 @@
|
||||
"runAsUser": {
|
||||
"type": "number",
|
||||
"description": "Set runAsUser in backend container' Security Context",
|
||||
"default": 1000
|
||||
"default": 1001
|
||||
},
|
||||
"runAsGroup": {
|
||||
"type": "number",
|
||||
"description": "Set runAsGroup in backend container' Security Context",
|
||||
"default": 1000
|
||||
"default": 1001
|
||||
},
|
||||
"runAsNonRoot": {
|
||||
"type": "boolean",
|
||||
@@ -1056,12 +1056,12 @@
|
||||
"runAsUser": {
|
||||
"type": "number",
|
||||
"description": "Set runAsUser in frontend container' Security Context",
|
||||
"default": 101
|
||||
"default": 1001
|
||||
},
|
||||
"runAsGroup": {
|
||||
"type": "number",
|
||||
"description": "Set runAsGroup in frontend container' Security Context",
|
||||
"default": 101
|
||||
"default": 1001
|
||||
},
|
||||
"runAsNonRoot": {
|
||||
"type": "boolean",
|
||||
@@ -1675,12 +1675,12 @@
|
||||
"runAsUser": {
|
||||
"type": "number",
|
||||
"description": "Set runAsUser in orborus container' Security Context",
|
||||
"default": 101
|
||||
"default": 1001
|
||||
},
|
||||
"runAsGroup": {
|
||||
"type": "number",
|
||||
"description": "Set runAsGroup in orborus container' Security Context",
|
||||
"default": 101
|
||||
"default": 1001
|
||||
},
|
||||
"runAsNonRoot": {
|
||||
"type": "boolean",
|
||||
|
||||
@@ -235,8 +235,8 @@ backend:
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsUser: 1001
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: false
|
||||
@@ -683,11 +683,12 @@ frontend:
|
||||
## @param frontend.podSecurityContext.fsGroup Set fsGroup in frontend pods' Security Context
|
||||
##
|
||||
podSecurityContext:
|
||||
enabled: false
|
||||
enabled: false # The default shuffle frontend image does not support running as non-root, because /etc/nginx/nginx.conf is written on startup
|
||||
fsGroupChangePolicy: Always
|
||||
sysctls: []
|
||||
supplementalGroups: []
|
||||
fsGroup: 1001
|
||||
|
||||
## Configure Container Security Context
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
|
||||
## @param frontend.containerSecurityContext.enabled Enabled frontend container' Security Context
|
||||
@@ -702,10 +703,10 @@ frontend:
|
||||
## @param frontend.containerSecurityContext.seccompProfile.type Set seccomp profile in frontend container
|
||||
##
|
||||
containerSecurityContext:
|
||||
enabled: false
|
||||
enabled: false # The default shuffle frontend image does not support running as non-root, because /etc/nginx/nginx.conf is written on startup
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 101
|
||||
runAsGroup: 101
|
||||
runAsUser: 1001
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: false
|
||||
@@ -1107,8 +1108,8 @@ orborus:
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 101
|
||||
runAsGroup: 101
|
||||
runAsUser: 1001
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: false
|
||||
|
||||
Reference in New Issue
Block a user