From 7b02ab8cdeba369a069714b41276c3d75d2eaf95 Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Wed, 4 Jun 2025 13:32:01 +0100 Subject: [PATCH 01/16] Resolve SNYK-CC-K8S-6, SNYK-CC-K8S-9, SNYK-CC-K8S-10 Signed-off-by: Fortune-Ndlovu --- charts/backstage/templates/sonataflows.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/charts/backstage/templates/sonataflows.yaml b/charts/backstage/templates/sonataflows.yaml index ad4a9809..ba80ae3f 100644 --- a/charts/backstage/templates/sonataflows.yaml +++ b/charts/backstage/templates/sonataflows.yaml @@ -111,6 +111,12 @@ spec: containers: - name: psql image: "{{- tpl .Values.orchestrator.sonataflowPlatform.createDBJobImage . -}}" + securityContext: + runAsNonRoot: true + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL env: - name: PGPASSWORD valueFrom: From 08cd41560a9e023254f8d3050383d231d804e39d Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Wed, 4 Jun 2025 13:48:38 +0100 Subject: [PATCH 02/16] Resolve Low issues Signed-off-by: Fortune-Ndlovu --- charts/backstage/templates/sonataflows.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/charts/backstage/templates/sonataflows.yaml b/charts/backstage/templates/sonataflows.yaml index ba80ae3f..4a817fbc 100644 --- a/charts/backstage/templates/sonataflows.yaml +++ b/charts/backstage/templates/sonataflows.yaml @@ -93,6 +93,13 @@ spec: initContainers: - name: wait-for-db image: "{{- tpl .Values.orchestrator.sonataflowPlatform.initContainerImage . -}}" + resources: + limits: + cpu: "100m" + memory: "64Mi" + requests: + cpu: "50m" + memory: "32Mi" command: - bash - -c @@ -113,10 +120,19 @@ spec: image: "{{- tpl .Values.orchestrator.sonataflowPlatform.createDBJobImage . -}}" securityContext: runAsNonRoot: true + runAsUser: 10001 readOnlyRootFilesystem: true + allowPrivilegeEscalation: false capabilities: drop: - ALL + resources: + limits: + cpu: "100m" + memory: "128Mi" + requests: + cpu: "50m" + memory: "64Mi" env: - name: PGPASSWORD valueFrom: From bd17011909752527d2a99d319cd42f81ef60be43 Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Thu, 5 Jun 2025 15:57:02 +0100 Subject: [PATCH 03/16] fix indent Signed-off-by: Fortune-Ndlovu --- charts/backstage/templates/sonataflows.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/charts/backstage/templates/sonataflows.yaml b/charts/backstage/templates/sonataflows.yaml index 4a817fbc..082e7f9b 100644 --- a/charts/backstage/templates/sonataflows.yaml +++ b/charts/backstage/templates/sonataflows.yaml @@ -93,13 +93,13 @@ spec: initContainers: - name: wait-for-db image: "{{- tpl .Values.orchestrator.sonataflowPlatform.initContainerImage . -}}" - resources: - limits: - cpu: "100m" - memory: "64Mi" - requests: - cpu: "50m" - memory: "32Mi" + resources: + limits: + cpu: "100m" + memory: "64Mi" + requests: + cpu: "50m" + memory: "32Mi" command: - bash - -c From 0b6217ba878cdff73f39ec7d785929122b90b419 Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Thu, 5 Jun 2025 17:33:52 +0100 Subject: [PATCH 04/16] fix containerSecurityContext Signed-off-by: Fortune-Ndlovu --- charts/backstage/templates/sonataflows.yaml | 23 +++++++++++++------ .../templates/tests/test-connection.yaml | 4 ++-- charts/backstage/values.schema.json | 1 + charts/backstage/values.yaml | 13 +++++++++-- 4 files changed, 30 insertions(+), 11 deletions(-) diff --git a/charts/backstage/templates/sonataflows.yaml b/charts/backstage/templates/sonataflows.yaml index 082e7f9b..f2d948b8 100644 --- a/charts/backstage/templates/sonataflows.yaml +++ b/charts/backstage/templates/sonataflows.yaml @@ -92,6 +92,15 @@ spec: spec: initContainers: - name: wait-for-db + securityContext: + runAsUser: 10001 + runAsGroup: 10001 + runAsNonRoot: true + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL image: "{{- tpl .Values.orchestrator.sonataflowPlatform.initContainerImage . -}}" resources: limits: @@ -118,6 +127,13 @@ spec: containers: - name: psql image: "{{- tpl .Values.orchestrator.sonataflowPlatform.createDBJobImage . -}}" + resources: + limits: + cpu: "100m" + memory: "128Mi" + requests: + cpu: "100m" + memory: "64Mi" securityContext: runAsNonRoot: true runAsUser: 10001 @@ -126,13 +142,6 @@ spec: capabilities: drop: - ALL - resources: - limits: - cpu: "100m" - memory: "128Mi" - requests: - cpu: "50m" - memory: "64Mi" env: - name: PGPASSWORD valueFrom: diff --git a/charts/backstage/templates/tests/test-connection.yaml b/charts/backstage/templates/tests/test-connection.yaml index b8aee686..9e8a03d0 100644 --- a/charts/backstage/templates/tests/test-connection.yaml +++ b/charts/backstage/templates/tests/test-connection.yaml @@ -18,7 +18,8 @@ spec: readOnlyRootFilesystem: true capabilities: drop: ["ALL"] - runAsNonRoot: false + runAsNonRoot: true + runAsUser: 10001 resources: requests: cpu: 10m @@ -32,7 +33,6 @@ spec: - ls - /usr/bin/curl image: "{{ .Values.test.image.registry }}/{{ .Values.test.image.repository }}:{{ .Values.test.image.tag }}" - imagePullPolicy: IfNotPresent command: ["/bin/sh", "-c"] args: - | diff --git a/charts/backstage/values.schema.json b/charts/backstage/values.schema.json index d9148d43..a2c22d85 100644 --- a/charts/backstage/values.schema.json +++ b/charts/backstage/values.schema.json @@ -4522,6 +4522,7 @@ }, "readOnlyRootFilesystem": true, "runAsNonRoot": true, + "runAsUser": 10001, "seccompProfile": { "type": "RuntimeDefault" } diff --git a/charts/backstage/values.yaml b/charts/backstage/values.yaml index c6fb9c7b..f8da6f54 100644 --- a/charts/backstage/values.yaml +++ b/charts/backstage/values.yaml @@ -68,6 +68,7 @@ upstream: subject: legacy-default-config secret: ${BACKEND_SECRET} containerSecurityContext: + runAsUser: 10001 readOnlyRootFilesystem: true allowPrivilegeEscalation: false capabilities: @@ -197,6 +198,7 @@ upstream: capabilities: drop: ["ALL"] runAsNonRoot: true + runAsUser: 10001 seccompProfile: type: "RuntimeDefault" # -- Image used by the initContainer to install dynamic plugins into the `dynamic-plugins-root` volume mount. @@ -258,11 +260,17 @@ upstream: adminPasswordKey: postgres-password userPasswordKey: password primary: - # TODO: https://issues.redhat.com/browse/RHIDP-2645 podSecurityContext: enabled: false containerSecurityContext: - enabled: false + enabled: true + runAsUser: 10001 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL resources: requests: cpu: 250m @@ -345,6 +353,7 @@ test: # -- Test connection pod image tag. Note that the image needs to have both the `sh` and `curl` binaries in it. tag: latest + orchestrator: enabled: false serverlessLogicOperator: From 6132dc0867e3d130c25b66ea439bc0d57205341c Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Thu, 5 Jun 2025 18:25:45 +0100 Subject: [PATCH 05/16] fix imagePullPolicy in test-connection Signed-off-by: Fortune-Ndlovu --- charts/backstage/templates/tests/test-connection.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/charts/backstage/templates/tests/test-connection.yaml b/charts/backstage/templates/tests/test-connection.yaml index 9e8a03d0..6582545c 100644 --- a/charts/backstage/templates/tests/test-connection.yaml +++ b/charts/backstage/templates/tests/test-connection.yaml @@ -13,6 +13,7 @@ metadata: spec: containers: - name: curl + imagePullPolicy: Always securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true From ec9333d92b7c6b2272e72d9da26f218f3b44ba14 Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Thu, 5 Jun 2025 18:45:23 +0100 Subject: [PATCH 06/16] add pull_request to trigger and test PR behavior Signed-off-by: Fortune-Ndlovu --- .github/workflows/snyk.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/snyk.yaml b/.github/workflows/snyk.yaml index d458ab2c..c54ea628 100644 --- a/.github/workflows/snyk.yaml +++ b/.github/workflows/snyk.yaml @@ -4,7 +4,7 @@ on: workflow_dispatch: # allow manual runs from UI schedule: - cron: "0 0 * * 0" # weekly scan (every Sunday at 00:00 UTC) - + pull_request: # trigger to test PR behavior jobs: scan-iac: name: Scan Rendered Templates (${{ matrix.chartConfig.name }}) From 2acfa6e16f20932e273c23df293fab46fd0f55c9 Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Thu, 5 Jun 2025 19:33:47 +0100 Subject: [PATCH 07/16] remove pull_request to trigger and test PR behavior Signed-off-by: Fortune-Ndlovu --- .github/workflows/snyk.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/snyk.yaml b/.github/workflows/snyk.yaml index c54ea628..d458ab2c 100644 --- a/.github/workflows/snyk.yaml +++ b/.github/workflows/snyk.yaml @@ -4,7 +4,7 @@ on: workflow_dispatch: # allow manual runs from UI schedule: - cron: "0 0 * * 0" # weekly scan (every Sunday at 00:00 UTC) - pull_request: # trigger to test PR behavior + jobs: scan-iac: name: Scan Rendered Templates (${{ matrix.chartConfig.name }}) From 0a802f85079fefa2b47e240b2a0f5f15b97fd422 Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Fri, 6 Jun 2025 10:04:16 +0100 Subject: [PATCH 08/16] bump chart version Signed-off-by: Fortune-Ndlovu --- charts/backstage/Chart.yaml | 2 +- charts/backstage/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/backstage/Chart.yaml b/charts/backstage/Chart.yaml index 15246d7b..f919642c 100644 --- a/charts/backstage/Chart.yaml +++ b/charts/backstage/Chart.yaml @@ -50,4 +50,4 @@ sources: [] # Versions are expected to follow Semantic Versioning (https://semver.org/) # Note that when this chart is published to https://github.com/openshift-helm-charts/charts # it will follow the RHDH versioning 1.y.z -version: 4.2.7 +version: 4.2.8 diff --git a/charts/backstage/README.md b/charts/backstage/README.md index df5850f3..4e1f1b21 100644 --- a/charts/backstage/README.md +++ b/charts/backstage/README.md @@ -1,7 +1,7 @@ # RHDH Backstage Helm Chart for OpenShift (Community Version) -![Version: 4.2.7](https://img.shields.io/badge/Version-4.2.7-informational?style=flat-square) +![Version: 4.2.8](https://img.shields.io/badge/Version-4.2.8-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) Red Hat Developer Hub is a Red Hat supported version of Backstage. From 1cb56385358a231ce2e362c43a9b6399ccb9245a Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Fri, 6 Jun 2025 16:02:25 +0100 Subject: [PATCH 09/16] Remove readOnlyRootFilesystem: true from PostgreSQL only Signed-off-by: Fortune-Ndlovu --- charts/backstage/values.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/charts/backstage/values.yaml b/charts/backstage/values.yaml index f8da6f54..a05255f9 100644 --- a/charts/backstage/values.yaml +++ b/charts/backstage/values.yaml @@ -267,7 +267,6 @@ upstream: runAsUser: 10001 runAsNonRoot: true allowPrivilegeEscalation: false - readOnlyRootFilesystem: true capabilities: drop: - ALL From abe8dfc3d5a1a2b1a40d5008d1e8c4fecdd83762 Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Mon, 16 Jun 2025 12:16:05 +0100 Subject: [PATCH 10/16] disable container security context Signed-off-by: Fortune-Ndlovu --- charts/backstage/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/backstage/values.yaml b/charts/backstage/values.yaml index a05255f9..12fb25be 100644 --- a/charts/backstage/values.yaml +++ b/charts/backstage/values.yaml @@ -263,7 +263,7 @@ upstream: podSecurityContext: enabled: false containerSecurityContext: - enabled: true + enabled: false runAsUser: 10001 runAsNonRoot: true allowPrivilegeEscalation: false From ee97742dd1094f7f42f28d00f241c099a2d05c8a Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Mon, 16 Jun 2025 14:58:06 +0100 Subject: [PATCH 11/16] remove runAsUser and runAsGroup Signed-off-by: Fortune-Ndlovu --- charts/backstage/templates/sonataflows.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/charts/backstage/templates/sonataflows.yaml b/charts/backstage/templates/sonataflows.yaml index f2d948b8..5e228302 100644 --- a/charts/backstage/templates/sonataflows.yaml +++ b/charts/backstage/templates/sonataflows.yaml @@ -93,8 +93,6 @@ spec: initContainers: - name: wait-for-db securityContext: - runAsUser: 10001 - runAsGroup: 10001 runAsNonRoot: true readOnlyRootFilesystem: true allowPrivilegeEscalation: false From dd5b342b86588a9397205b6e131a658fd2171f91 Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Mon, 16 Jun 2025 15:00:23 +0100 Subject: [PATCH 12/16] Chart version bumped Signed-off-by: Fortune-Ndlovu --- charts/backstage/Chart.yaml | 2 +- charts/backstage/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/backstage/Chart.yaml b/charts/backstage/Chart.yaml index ec45fbff..afa4c66c 100644 --- a/charts/backstage/Chart.yaml +++ b/charts/backstage/Chart.yaml @@ -50,4 +50,4 @@ sources: [] # Versions are expected to follow Semantic Versioning (https://semver.org/) # Note that when this chart is published to https://github.com/openshift-helm-charts/charts # it will follow the RHDH versioning 1.y.z -version: 4.2.8 +version: 4.2.9 diff --git a/charts/backstage/README.md b/charts/backstage/README.md index c8406266..cb3468f3 100644 --- a/charts/backstage/README.md +++ b/charts/backstage/README.md @@ -1,7 +1,7 @@ # RHDH Backstage Helm Chart for OpenShift (Community Version) -![Version: 4.2.8](https://img.shields.io/badge/Version-4.2.8-informational?style=flat-square) +![Version: 4.2.9](https://img.shields.io/badge/Version-4.2.9-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) Red Hat Developer Hub is a Red Hat supported version of Backstage. From d4c5f383e1862d9c9f98a3b0cc87eeed4f8f7ef3 Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Tue, 17 Jun 2025 13:06:49 +0100 Subject: [PATCH 13/16] Dont set runAsUser as ocp usually randomly assigns a high UID to each pod and does not allow hardcoding UIDs by default. Signed-off-by: Fortune-Ndlovu --- charts/backstage/templates/sonataflows.yaml | 1 - charts/backstage/templates/tests/test-connection.yaml | 1 - charts/backstage/values.schema.json | 1 - charts/backstage/values.yaml | 3 --- 4 files changed, 6 deletions(-) diff --git a/charts/backstage/templates/sonataflows.yaml b/charts/backstage/templates/sonataflows.yaml index 5e228302..561f2061 100644 --- a/charts/backstage/templates/sonataflows.yaml +++ b/charts/backstage/templates/sonataflows.yaml @@ -134,7 +134,6 @@ spec: memory: "64Mi" securityContext: runAsNonRoot: true - runAsUser: 10001 readOnlyRootFilesystem: true allowPrivilegeEscalation: false capabilities: diff --git a/charts/backstage/templates/tests/test-connection.yaml b/charts/backstage/templates/tests/test-connection.yaml index 6582545c..dae32a2f 100644 --- a/charts/backstage/templates/tests/test-connection.yaml +++ b/charts/backstage/templates/tests/test-connection.yaml @@ -20,7 +20,6 @@ spec: capabilities: drop: ["ALL"] runAsNonRoot: true - runAsUser: 10001 resources: requests: cpu: 10m diff --git a/charts/backstage/values.schema.json b/charts/backstage/values.schema.json index a2c22d85..d9148d43 100644 --- a/charts/backstage/values.schema.json +++ b/charts/backstage/values.schema.json @@ -4522,7 +4522,6 @@ }, "readOnlyRootFilesystem": true, "runAsNonRoot": true, - "runAsUser": 10001, "seccompProfile": { "type": "RuntimeDefault" } diff --git a/charts/backstage/values.yaml b/charts/backstage/values.yaml index 12fb25be..76215c21 100644 --- a/charts/backstage/values.yaml +++ b/charts/backstage/values.yaml @@ -68,7 +68,6 @@ upstream: subject: legacy-default-config secret: ${BACKEND_SECRET} containerSecurityContext: - runAsUser: 10001 readOnlyRootFilesystem: true allowPrivilegeEscalation: false capabilities: @@ -198,7 +197,6 @@ upstream: capabilities: drop: ["ALL"] runAsNonRoot: true - runAsUser: 10001 seccompProfile: type: "RuntimeDefault" # -- Image used by the initContainer to install dynamic plugins into the `dynamic-plugins-root` volume mount. @@ -264,7 +262,6 @@ upstream: enabled: false containerSecurityContext: enabled: false - runAsUser: 10001 runAsNonRoot: true allowPrivilegeEscalation: false capabilities: From ed2d816146843573110fe8d403bd75e57d0c215f Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Tue, 17 Jun 2025 14:49:35 +0100 Subject: [PATCH 14/16] Remove all runAsNonRoot: true settings for now to get your tests passing. Signed-off-by: Fortune-Ndlovu --- charts/backstage/templates/sonataflows.yaml | 2 -- charts/backstage/templates/tests/test-connection.yaml | 1 - charts/backstage/values.schema.json | 1 - charts/backstage/values.yaml | 3 --- 4 files changed, 7 deletions(-) diff --git a/charts/backstage/templates/sonataflows.yaml b/charts/backstage/templates/sonataflows.yaml index 561f2061..b57d6e82 100644 --- a/charts/backstage/templates/sonataflows.yaml +++ b/charts/backstage/templates/sonataflows.yaml @@ -93,7 +93,6 @@ spec: initContainers: - name: wait-for-db securityContext: - runAsNonRoot: true readOnlyRootFilesystem: true allowPrivilegeEscalation: false capabilities: @@ -133,7 +132,6 @@ spec: cpu: "100m" memory: "64Mi" securityContext: - runAsNonRoot: true readOnlyRootFilesystem: true allowPrivilegeEscalation: false capabilities: diff --git a/charts/backstage/templates/tests/test-connection.yaml b/charts/backstage/templates/tests/test-connection.yaml index dae32a2f..e690eff1 100644 --- a/charts/backstage/templates/tests/test-connection.yaml +++ b/charts/backstage/templates/tests/test-connection.yaml @@ -19,7 +19,6 @@ spec: readOnlyRootFilesystem: true capabilities: drop: ["ALL"] - runAsNonRoot: true resources: requests: cpu: 10m diff --git a/charts/backstage/values.schema.json b/charts/backstage/values.schema.json index d9148d43..3e8107d8 100644 --- a/charts/backstage/values.schema.json +++ b/charts/backstage/values.schema.json @@ -4521,7 +4521,6 @@ ] }, "readOnlyRootFilesystem": true, - "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } diff --git a/charts/backstage/values.yaml b/charts/backstage/values.yaml index 76215c21..d746c8a7 100644 --- a/charts/backstage/values.yaml +++ b/charts/backstage/values.yaml @@ -72,7 +72,6 @@ upstream: allowPrivilegeEscalation: false capabilities: drop: ["ALL"] - runAsNonRoot: true seccompProfile: type: "RuntimeDefault" resources: @@ -196,7 +195,6 @@ upstream: allowPrivilegeEscalation: false capabilities: drop: ["ALL"] - runAsNonRoot: true seccompProfile: type: "RuntimeDefault" # -- Image used by the initContainer to install dynamic plugins into the `dynamic-plugins-root` volume mount. @@ -262,7 +260,6 @@ upstream: enabled: false containerSecurityContext: enabled: false - runAsNonRoot: true allowPrivilegeEscalation: false capabilities: drop: From eb69721cd736c042fc6bf8749c7f2f4319a4ba02 Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Thu, 19 Jun 2025 15:23:26 +0100 Subject: [PATCH 15/16] fixup Signed-off-by: Fortune-Ndlovu --- charts/backstage/templates/sonataflows.yaml | 2 ++ charts/backstage/templates/tests/test-connection.yaml | 2 +- charts/backstage/values.schema.json | 1 + charts/backstage/values.yaml | 4 +++- 4 files changed, 7 insertions(+), 2 deletions(-) diff --git a/charts/backstage/templates/sonataflows.yaml b/charts/backstage/templates/sonataflows.yaml index b57d6e82..d005c447 100644 --- a/charts/backstage/templates/sonataflows.yaml +++ b/charts/backstage/templates/sonataflows.yaml @@ -95,6 +95,7 @@ spec: securityContext: readOnlyRootFilesystem: true allowPrivilegeEscalation: false + runAsNonRoot: true capabilities: drop: - ALL @@ -134,6 +135,7 @@ spec: securityContext: readOnlyRootFilesystem: true allowPrivilegeEscalation: false + runAsNonRoot: true capabilities: drop: - ALL diff --git a/charts/backstage/templates/tests/test-connection.yaml b/charts/backstage/templates/tests/test-connection.yaml index e690eff1..a8966069 100644 --- a/charts/backstage/templates/tests/test-connection.yaml +++ b/charts/backstage/templates/tests/test-connection.yaml @@ -13,6 +13,7 @@ metadata: spec: containers: - name: curl + image: "{{ .Values.test.image.registry }}/{{ .Values.test.image.repository }}:{{ .Values.test.image.tag }}" imagePullPolicy: Always securityContext: allowPrivilegeEscalation: false @@ -31,7 +32,6 @@ spec: command: - ls - /usr/bin/curl - image: "{{ .Values.test.image.registry }}/{{ .Values.test.image.repository }}:{{ .Values.test.image.tag }}" command: ["/bin/sh", "-c"] args: - | diff --git a/charts/backstage/values.schema.json b/charts/backstage/values.schema.json index 3e8107d8..d9148d43 100644 --- a/charts/backstage/values.schema.json +++ b/charts/backstage/values.schema.json @@ -4521,6 +4521,7 @@ ] }, "readOnlyRootFilesystem": true, + "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } diff --git a/charts/backstage/values.yaml b/charts/backstage/values.yaml index d746c8a7..474f1104 100644 --- a/charts/backstage/values.yaml +++ b/charts/backstage/values.yaml @@ -72,6 +72,7 @@ upstream: allowPrivilegeEscalation: false capabilities: drop: ["ALL"] + runAsNonRoot: true seccompProfile: type: "RuntimeDefault" resources: @@ -195,6 +196,7 @@ upstream: allowPrivilegeEscalation: false capabilities: drop: ["ALL"] + runAsNonRoot: true seccompProfile: type: "RuntimeDefault" # -- Image used by the initContainer to install dynamic plugins into the `dynamic-plugins-root` volume mount. @@ -256,6 +258,7 @@ upstream: adminPasswordKey: postgres-password userPasswordKey: password primary: + # TODO: https://issues.redhat.com/browse/RHIDP-2645 podSecurityContext: enabled: false containerSecurityContext: @@ -346,7 +349,6 @@ test: # -- Test connection pod image tag. Note that the image needs to have both the `sh` and `curl` binaries in it. tag: latest - orchestrator: enabled: false serverlessLogicOperator: From 4b05bae13b88a373d0d50f5a36ba9c92ba70a023 Mon Sep 17 00:00:00 2001 From: Fortune-Ndlovu Date: Thu, 19 Jun 2025 15:25:10 +0100 Subject: [PATCH 16/16] imagePullPolicy below image Signed-off-by: Fortune-Ndlovu --- charts/backstage/templates/tests/test-connection.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/backstage/templates/tests/test-connection.yaml b/charts/backstage/templates/tests/test-connection.yaml index a8966069..85205b25 100644 --- a/charts/backstage/templates/tests/test-connection.yaml +++ b/charts/backstage/templates/tests/test-connection.yaml @@ -13,8 +13,6 @@ metadata: spec: containers: - name: curl - image: "{{ .Values.test.image.registry }}/{{ .Values.test.image.repository }}:{{ .Values.test.image.tag }}" - imagePullPolicy: Always securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -32,6 +30,8 @@ spec: command: - ls - /usr/bin/curl + image: "{{ .Values.test.image.registry }}/{{ .Values.test.image.repository }}:{{ .Values.test.image.tag }}" + imagePullPolicy: Always command: ["/bin/sh", "-c"] args: - |