charts icon indicating copy to clipboard operation
charts copied to clipboard

[jfrog-platform] Added podSecurityContext and containerSecurityContext for pre-upgrade-check migration hook container

Open mrarends opened this issue 4 months ago • 1 comments

PR Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

  • [x] Chart Version bumped
  • [x] CHANGELOG.md updated
  • [ ] Variables and other changes are documented in the README.md
  • [x] Title of the PR starts with chart name (e.g. [artifactory])

What this PR does / why we need it: The new pre-upgrade-check pod and container is missing the option to set security context settings. On clusters that require more strict settings the pre-upgrade-check can not be started:

violates PodSecurity'

	(combined from similar events): Error creating: pods "jfrog-platform-pre-upgrade-check-j527c" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "pre-upgrade-check" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "pre-upgrade-check" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "pre-upgrade-check" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "pre-upgrade-check" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

Special notes for your reviewer:

mrarends avatar Oct 14 '24 09:10 mrarends