chore(fix): Resolve Snyk IaC Findings for RHDH Helm Chart (with and without Orchestrator)

charts/backstage/Chart.yaml

@@ -50,4 +50,4 @@ sources: []
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
 # Note that when this chart is published to https://github.com/openshift-helm-charts/charts
 # it will follow the RHDH versioning 1.y.z
-version: 4.2.8
+version: 4.2.9

charts/backstage/README.md

@@ -1,7 +1,7 @@
 
 # RHDH Backstage Helm Chart for OpenShift (Community Version)
 
-![Version: 4.2.8](https://img.shields.io/badge/Version-4.2.8-informational?style=flat-square)
+![Version: 4.2.9](https://img.shields.io/badge/Version-4.2.9-informational?style=flat-square)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Red Hat Developer Hub is a Red Hat supported version of Backstage.

charts/backstage/templates/sonataflows.yaml

@@ -92,7 +92,21 @@ spec:
     spec:
       initContainers:
         - name: wait-for-db
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
           image: "{{- tpl .Values.orchestrator.sonataflowPlatform.initContainerImage . -}}"
+          resources:
+            limits:
+              cpu: "100m"
+              memory: "64Mi"
+            requests:
+              cpu: "50m"
+              memory: "32Mi"
           command:
             - bash
             - -c
@@ -111,6 +125,20 @@ spec:
       containers:
       - name: psql
         image: "{{- tpl .Values.orchestrator.sonataflowPlatform.createDBJobImage . -}}"
+        resources:
+          limits:
+            cpu: "100m"
+            memory: "128Mi"
+          requests:
+            cpu: "100m"
+            memory: "64Mi"
+        securityContext:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+          runAsNonRoot: true
+          capabilities:
+            drop:
+              - ALL
         env:
         - name: PGPASSWORD
           valueFrom:

charts/backstage/templates/tests/test-connection.yaml

@@ -18,7 +18,6 @@ spec:
         readOnlyRootFilesystem: true
         capabilities:
           drop: ["ALL"]
-        runAsNonRoot: false
       resources:
         requests:
           cpu: 10m
@@ -32,7 +31,7 @@ spec:
           - ls
           - /usr/bin/curl
       image: "{{ .Values.test.image.registry }}/{{ .Values.test.image.repository }}:{{ .Values.test.image.tag }}"
-      imagePullPolicy: IfNotPresent
+      imagePullPolicy: Always
       command: ["/bin/sh", "-c"]
       args:
         - |

charts/backstage/values.yaml

@@ -263,6 +263,10 @@ upstream:
         enabled: false
       containerSecurityContext:
         enabled: false
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
       resources:
         requests:
           cpu: 250m