From 033ee4302c60e55cb490a75aaa3c34b229997602 Mon Sep 17 00:00:00 2001 From: Marcos Bjoerkelund Date: Wed, 3 Jun 2020 20:05:33 +0200 Subject: [PATCH] [bitnami/phpmyadmin] Add non-root notice in README and add securityContext to change UID (#2740) * [bitnami/phpmyadmin] Add non-root notice in README and add securityContext to change UID * move to podSecurityContext and containerSecurityContext * remove reference to old var * [bitnami/phpmyadmin] Update components versions Signed-off-by: Bitnami Containers Co-authored-by: Bitnami Containers --- bitnami/phpmyadmin/Chart.yaml | 2 +- bitnami/phpmyadmin/README.md | 15 +++++++++++++++ bitnami/phpmyadmin/requirements.lock | 6 +++--- bitnami/phpmyadmin/templates/deployment.yaml | 6 ++++++ bitnami/phpmyadmin/values.yaml | 14 +++++++++++++- 5 files changed, 38 insertions(+), 5 deletions(-) diff --git a/bitnami/phpmyadmin/Chart.yaml b/bitnami/phpmyadmin/Chart.yaml index 6555d52fa..ccb0cb078 100644 --- a/bitnami/phpmyadmin/Chart.yaml +++ b/bitnami/phpmyadmin/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: phpmyadmin -version: 6.1.0 +version: 6.2.0 appVersion: 5.0.2 description: phpMyAdmin is an mysql administration frontend keywords: diff --git a/bitnami/phpmyadmin/README.md b/bitnami/phpmyadmin/README.md index fc5146401..d406fee92 100644 --- a/bitnami/phpmyadmin/README.md +++ b/bitnami/phpmyadmin/README.md @@ -78,6 +78,8 @@ The following table lists the configurable parameters of the phpMyAdmin chart an | `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | | `ingress.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` | | `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `phpmyadmin.local-tls-secret` | +| `podSecurityContext` | phpMyAdmin pods' Security Context | `{ fsGroup: "1001" }` | +| `containerSecurityContext` | phpMyAdmin containers' Security Context | `{ runAsUser: "1001" }` | | `resources.limits` | The resources limits for the PhpMyAdmin container | `{}` | | `resources.requests` | The requested resources for the PhpMyAdmin container | `{}` | | `livenessProbe` | Liveness probe configuration for PhpMyAdmin | `Check values.yaml file` | @@ -125,6 +127,19 @@ Bitnami will release a new chart updating its containers if a new version of the ## Upgrading +### To 6.0.0 + +The [Bitnami phpMyAdmin](https://github.com/bitnami/bitnami-docker-phpmyadmin) image was migrated to a "non-root" user approach. Previously the container ran as the `root` user and the Apache daemon was started as the `daemon` user. From now on, both the container and the Apache daemon run as user `1001`. You can revert this behavior by setting the parameters `containerSecurityContext.runAsUser` to `root`. +Chart labels and Ingress configuration were also adapted to follow the Helm charts best practices. + +Consequences: + +- The HTTP/HTTPS ports exposed by the container are now `8080/8443` instead of `80/443`. +- No writing permissions will be granted on `config.inc.php` by default. +- Backwards compatibility is not guaranteed. + +To upgrade to `6.0.0`, backup your previous MariaDB databases, install a new phpMyAdmin chart and import the MariaDB backups. + ### To 1.0.0 Backwards compatibility is not guaranteed unless you modify the labels used on the chart's deployments. diff --git a/bitnami/phpmyadmin/requirements.lock b/bitnami/phpmyadmin/requirements.lock index f7e4fffcd..fc0084b79 100644 --- a/bitnami/phpmyadmin/requirements.lock +++ b/bitnami/phpmyadmin/requirements.lock @@ -4,6 +4,6 @@ dependencies: version: 0.3.0 - name: mariadb repository: https://charts.bitnami.com/bitnami - version: 7.4.3 -digest: sha256:4af7bb2ed2521abbfc12c46d8b3f940165bfaee82cbc9616c39e6e6060dac484 -generated: "2020-06-03T06:35:43.861448336Z" + version: 7.5.0 +digest: sha256:57604e8a4c110cc563061c86335cae26b9889f4ec06a594a5127ae3b9fb9770f +generated: "2020-06-03T12:00:55.031262048Z" diff --git a/bitnami/phpmyadmin/templates/deployment.yaml b/bitnami/phpmyadmin/templates/deployment.yaml index d016ab252..4bf38be81 100644 --- a/bitnami/phpmyadmin/templates/deployment.yaml +++ b/bitnami/phpmyadmin/templates/deployment.yaml @@ -42,6 +42,9 @@ spec: {{- with .Values.tolerations }} tolerations: {{ toYaml . | nindent 8 }} {{- end }} + {{- if .Values.podSecurityContext }} + securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- end }} hostAliases: - ip: "127.0.0.1" hostnames: @@ -50,6 +53,9 @@ spec: - name: {{ .Chart.Name }} image: {{ template "phpmyadmin.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- if .Values.containerSecurityContext }} + securityContext: {{- toYaml .Values.containerSecurityContext | nindent 12 }} + {{- end }} env: - name: DATABASE_PORT_NUMBER value: {{ .Values.db.port | quote }} diff --git a/bitnami/phpmyadmin/values.yaml b/bitnami/phpmyadmin/values.yaml index d5151b4f9..cdde6bc3d 100644 --- a/bitnami/phpmyadmin/values.yaml +++ b/bitnami/phpmyadmin/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/phpmyadmin - tag: 5.0.2-debian-10-r74 + tag: 5.0.2-debian-10-r75 ## Specify a imagePullPolicy pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. @@ -119,6 +119,18 @@ ingress: ## If TLS is set to true, you must declare what secret will store the key/certificate for TLS tlsSecret: phpmyadmin.local-tls +## phpMyAdmin pods' Security Context +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod +## +podSecurityContext: + fsGroup: 1001 + +## phpMyAdmin containers' Security Context (only main container) +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container +## +containerSecurityContext: + runAsUser: 1001 + ## PhpMyAdmin containers' liveness and readiness probes. Evaluated as a template. ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes ##