From 470a40d08dd2a695ea7ebc74e016d2484eecfe1c Mon Sep 17 00:00:00 2001 From: juan131 Date: Tue, 27 Nov 2018 16:11:41 +0100 Subject: [PATCH] [bitnami/tomcat] Adapt Chart to non-root container --- bitnami/tomcat/Chart.yaml | 2 +- bitnami/tomcat/README.md | 45 +++++++++++++----------- bitnami/tomcat/templates/deployment.yaml | 5 +++ bitnami/tomcat/values.yaml | 8 +++++ 4 files changed, 38 insertions(+), 22 deletions(-) diff --git a/bitnami/tomcat/Chart.yaml b/bitnami/tomcat/Chart.yaml index adb089879..be98b8bcb 100644 --- a/bitnami/tomcat/Chart.yaml +++ b/bitnami/tomcat/Chart.yaml @@ -1,5 +1,5 @@ name: tomcat -version: 2.0.0 +version: 2.1.0 appVersion: 8.5.35 description: Chart for Apache Tomcat keywords: diff --git a/bitnami/tomcat/README.md b/bitnami/tomcat/README.md index 8df61dd45..ed688cffc 100644 --- a/bitnami/tomcat/README.md +++ b/bitnami/tomcat/README.md @@ -45,27 +45,30 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the Tomcat chart and their default values. -| Parameter | Description | Default | -|-------------------------------|----------------------------------------------|---------------------------------------------------------- | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `image.registry` | Tomcat image registry | `docker.io` | -| `image.repository` | Tomcat Image name | `bitnami/tomcat` | -| `image.tag` | Tomcat Image tag | `{VERSION}` | -| `image.pullPolicy` | Tomcat image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | -| `image.pullSecrets` | Specify image pull secrets | `nil` (does not add image pull secrets to deployed pods) | -| `tomcatUsername` | Tomcat admin user | `user` | -| `tomcatPassword` | Tomcat admin password | _random 10 character alphanumeric string_ | -| `tomcatAllowRemoteManagement` | Enable remote access to management interface | `0` (disabled) | -| `service.type` | Kubernetes Service type | `LoadBalancer` | -| `service.port` | Service HTTP port | `80` | -| `service.nodePorts.http` | Kubernetes http node port | `""` | -| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | -| `service.loadBalancerIP` | LoadBalancer service IP address | `""` | -| `persistence.enabled` | Enable persistence using PVC | `true` | -| `persistence.storageClass` | PVC Storage Class for Tomcat volume | `nil` (uses alpha storage class annotation) | -| `persistence.accessMode` | PVC Access Mode for Tomcat volume | `ReadWriteOnce` | -| `persistence.size` | PVC Storage Request for Tomcat volume | `8Gi` | -| `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | +| Parameter | Description | Default | +|---------------------------------|----------------------------------------------|---------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `image.registry` | Tomcat image registry | `docker.io` | +| `image.repository` | Tomcat Image name | `bitnami/tomcat` | +| `image.tag` | Tomcat Image tag | `{VERSION}` | +| `image.pullPolicy` | Tomcat image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | +| `image.pullSecrets` | Specify image pull secrets | `nil` (does not add image pull secrets to deployed pods) | +| `tomcatUsername` | Tomcat admin user | `user` | +| `tomcatPassword` | Tomcat admin password | _random 10 character alphanumeric string_ | +| `tomcatAllowRemoteManagement` | Enable remote access to management interface | `0` (disabled) | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `service.type` | Kubernetes Service type | `LoadBalancer` | +| `service.port` | Service HTTP port | `80` | +| `service.nodePorts.http` | Kubernetes http node port | `""` | +| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `service.loadBalancerIP` | LoadBalancer service IP address | `""` | +| `persistence.enabled` | Enable persistence using PVC | `true` | +| `persistence.storageClass` | PVC Storage Class for Tomcat volume | `nil` (uses alpha storage class annotation) | +| `persistence.accessMode` | PVC Access Mode for Tomcat volume | `ReadWriteOnce` | +| `persistence.size` | PVC Storage Request for Tomcat volume | `8Gi` | +| `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | The above parameters map to the env variables defined in [bitnami/tomcat](http://github.com/bitnami/bitnami-docker-tomcat). For more information please refer to the [bitnami/tomcat](http://github.com/bitnami/bitnami-docker-tomcat) image documentation. diff --git a/bitnami/tomcat/templates/deployment.yaml b/bitnami/tomcat/templates/deployment.yaml index 654da418d..3de54bd04 100644 --- a/bitnami/tomcat/templates/deployment.yaml +++ b/bitnami/tomcat/templates/deployment.yaml @@ -19,6 +19,11 @@ spec: chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" spec: + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end}} {{- if .Values.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} diff --git a/bitnami/tomcat/values.yaml b/bitnami/tomcat/values.yaml index 8bb519080..028ee34ac 100644 --- a/bitnami/tomcat/values.yaml +++ b/bitnami/tomcat/values.yaml @@ -23,6 +23,14 @@ image: # pullSecrets: # - myRegistrKeySecretName +## Pod Security Context +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +## +securityContext: + enabled: true + fsGroup: 1001 + runAsUser: 1001 + ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ##