Skip to content

Commit 51b27d9

Browse files
mikeshootzzmikeshootzz
committed
Add configuration for security contexts
1 parent 3e83da5 commit 51b27d9

File tree

3 files changed

+93
-1
lines changed

3 files changed

+93
-1
lines changed

‎charts/rcloneproxy/README.md‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,23 @@ A Helm chart for deploying rclone as an intermediate s3 proxy
4141
| backend.secretRef.keys.endpoint | string | `"endpoint"` | Key for S3 endpoint URL |
4242
| backend.secretRef.keys.region | string | `"region"` | Key for S3 region |
4343
| backend.secretRef.name | string | `""` | Name of the secret containing backend credentials |
44+
| containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"enabled":true,"readOnlyRootFilesystem":false,"runAsNonRoot":true,"runAsUser":65532}` | Container security context configuration |
45+
| containerSecurityContext.allowPrivilegeEscalation | bool | `false` | Disallow privilege escalation |
46+
| containerSecurityContext.capabilities | object | `{"drop":["ALL"]}` | Linux capabilities to drop |
47+
| containerSecurityContext.enabled | bool | `true` | Enable container security context |
48+
| containerSecurityContext.readOnlyRootFilesystem | bool | `false` | Read-only root filesystem |
49+
| containerSecurityContext.runAsNonRoot | bool | `true` | Run as non-root user |
50+
| containerSecurityContext.runAsUser | int | `65532` | User ID to run the container |
4451
| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
4552
| image.repository | string | `"rclone/rclone"` | Image repository for rclone |
4653
| image.tag | string | `"sha-73bcae2"` | Configure the image tag. To update to a newer version, use the commit sha from the tagged release |
54+
| podSecurityContext | object | `{"enabled":true,"fsGroup":65532,"fsGroupChangePolicy":"OnRootMismatch","seLinuxOptions":{}}` | Pod security context configuration |
55+
| podSecurityContext.enabled | bool | `true` | Enable pod security context |
56+
| podSecurityContext.fsGroup | int | `65532` | FSGroup for volume ownership |
57+
| podSecurityContext.fsGroupChangePolicy | string | `"OnRootMismatch"` | FSGroupChangePolicy for volume ownership changes |
58+
| podSecurityContext.seLinuxOptions | object | `{}` | SELinux options for OpenShift compatibility |
4759
| replicaCount | int | `1` | Number of replicas |
48-
| resources | object | `{"limits":{"cpu":"25m","memory":"128Mi"},"requests":{"cpu":"10m","memory":"96Mi"}}` | Resource requests and limits |
60+
| resources | object | `{"limits":{"cpu":"25m","memory":"512Mi"},"requests":{"cpu":"10m","memory":"256Mi"}}` | Resource requests and limits |
4961
| service | object | `{"port":9095,"type":"ClusterIP"}` | Service configuration |
5062
| service.port | int | `9095` | Service port (rclone S3 server port) |
5163
| service.type | string | `"ClusterIP"` | Service type |

‎charts/rcloneproxy/templates/deployment.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,42 @@ spec:
1414
labels:
1515
app: rcloneproxy
1616
spec:
17+
{{- if .Values.podSecurityContext.enabled }}
18+
securityContext:
19+
{{- if .Values.podSecurityContext.fsGroup }}
20+
fsGroup: {{ .Values.podSecurityContext.fsGroup }}
21+
{{- end }}
22+
{{- if .Values.podSecurityContext.fsGroupChangePolicy }}
23+
fsGroupChangePolicy: {{ .Values.podSecurityContext.fsGroupChangePolicy }}
24+
{{- end }}
25+
{{- if .Values.podSecurityContext.seLinuxOptions }}
26+
seLinuxOptions:
27+
{{- toYaml .Values.podSecurityContext.seLinuxOptions | nindent 10 }}
28+
{{- end }}
29+
{{- end }}
1730
initContainers:
1831
- name: generate-config
1932
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
2033
imagePullPolicy: {{ .Values.image.pullPolicy }}
34+
{{- if .Values.containerSecurityContext.enabled }}
35+
securityContext:
36+
{{- if .Values.containerSecurityContext.runAsUser }}
37+
runAsUser: {{ .Values.containerSecurityContext.runAsUser }}
38+
{{- end }}
39+
{{- if .Values.containerSecurityContext.runAsNonRoot }}
40+
runAsNonRoot: {{ .Values.containerSecurityContext.runAsNonRoot }}
41+
{{- end }}
42+
{{- if ne .Values.containerSecurityContext.allowPrivilegeEscalation nil }}
43+
allowPrivilegeEscalation: {{ .Values.containerSecurityContext.allowPrivilegeEscalation }}
44+
{{- end }}
45+
{{- if ne .Values.containerSecurityContext.readOnlyRootFilesystem nil }}
46+
readOnlyRootFilesystem: {{ .Values.containerSecurityContext.readOnlyRootFilesystem }}
47+
{{- end }}
48+
{{- if .Values.containerSecurityContext.capabilities }}
49+
capabilities:
50+
{{- toYaml .Values.containerSecurityContext.capabilities | nindent 14 }}
51+
{{- end }}
52+
{{- end }}
2153
command:
2254
- /bin/sh
2355
- -c
@@ -94,6 +126,25 @@ spec:
94126
- name: rcloneproxy
95127
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
96128
imagePullPolicy: {{ .Values.image.pullPolicy }}
129+
{{- if .Values.containerSecurityContext.enabled }}
130+
securityContext:
131+
{{- if .Values.containerSecurityContext.runAsUser }}
132+
runAsUser: {{ .Values.containerSecurityContext.runAsUser }}
133+
{{- end }}
134+
{{- if .Values.containerSecurityContext.runAsNonRoot }}
135+
runAsNonRoot: {{ .Values.containerSecurityContext.runAsNonRoot }}
136+
{{- end }}
137+
{{- if ne .Values.containerSecurityContext.allowPrivilegeEscalation nil }}
138+
allowPrivilegeEscalation: {{ .Values.containerSecurityContext.allowPrivilegeEscalation }}
139+
{{- end }}
140+
{{- if ne .Values.containerSecurityContext.readOnlyRootFilesystem nil }}
141+
readOnlyRootFilesystem: {{ .Values.containerSecurityContext.readOnlyRootFilesystem }}
142+
{{- end }}
143+
{{- if .Values.containerSecurityContext.capabilities }}
144+
capabilities:
145+
{{- toYaml .Values.containerSecurityContext.capabilities | nindent 14 }}
146+
{{- end }}
147+
{{- end }}
97148
command:
98149
- /bin/sh
99150
- -c

‎charts/rcloneproxy/values.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,32 @@ resources:
4343
limits:
4444
memory: "512Mi"
4545
cpu: "25m"
46+
47+
# -- Pod security context configuration
48+
podSecurityContext:
49+
# -- Enable pod security context
50+
enabled: true
51+
# -- FSGroup for volume ownership
52+
fsGroup: 65532
53+
# -- FSGroupChangePolicy for volume ownership changes
54+
fsGroupChangePolicy: "OnRootMismatch"
55+
# -- SELinux options for OpenShift compatibility
56+
seLinuxOptions: {}
57+
# type: "spc_t"
58+
59+
# -- Container security context configuration
60+
containerSecurityContext:
61+
# -- Enable container security context
62+
enabled: true
63+
# -- Run as non-root user
64+
runAsNonRoot: true
65+
# -- User ID to run the container
66+
runAsUser: 65532
67+
# -- Disallow privilege escalation
68+
allowPrivilegeEscalation: false
69+
# -- Read-only root filesystem
70+
readOnlyRootFilesystem: false
71+
# -- Linux capabilities to drop
72+
capabilities:
73+
drop:
74+
- ALL

0 commit comments

Comments
 (0)