Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: nats-server runs as non-root #319

Merged
merged 17 commits into from
Feb 21, 2024
Merged

fix: nats-server runs as non-root #319

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
c9ca63e
add debug messages to github action
friedrichwilken Feb 15, 2024
66d25c2
Run as non-root user
friedrichwilken Feb 15, 2024
6f91b14
Extend attempts
friedrichwilken Feb 15, 2024
eb5125f
Extend attempts
friedrichwilken Feb 15, 2024
d42bc5f
Change owner of storage via init container
friedrichwilken Feb 15, 2024
fa9b529
Change owner of jetstream storage
friedrichwilken Feb 15, 2024
cdb7f7d
Give root permissions to init container
friedrichwilken Feb 15, 2024
744140e
Change groups of owners
friedrichwilken Feb 15, 2024
282a5dd
Change only the JetStream storage
friedrichwilken Feb 15, 2024
1d879bd
Change usergroup to fsgroup
friedrichwilken Feb 15, 2024
219a060
Revert "extend attempts"
friedrichwilken Feb 16, 2024
063977b
Revert "extend attempts"
friedrichwilken Feb 16, 2024
096a541
Use alpine instead of busybox
friedrichwilken Feb 16, 2024
6128137
also change rights for files
friedrichwilken Feb 19, 2024
bc1af44
Add 'done' log message
friedrichwilken Feb 20, 2024
7071123
Revert "add debug messages to github action"
friedrichwilken Feb 21, 2024
6ac85ad
Rename initContainer
friedrichwilken Feb 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions resources/nats/templates/statefulset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,15 @@ spec:
# reload to the server without restarting the pod.
shareProcessNamespace: true

initContainers:
- name: change-storage-permissions
securityContext:
runAsUser: 0
image: alpine:latest
command: ["sh", "-c", "chown -R 1000:10001 {{ .Values.nats.jetstream.fileStorage.storageDirectory }} && chmod -R 755 {{ .Values.nats.jetstream.fileStorage.storageDirectory }} && echo 'Done!'"]
volumeMounts:
- name: {{ include "nats.fullname" . }}-js-pvc
mountPath: {{ .Values.nats.jetstream.fileStorage.storageDirectory }}
#################
# #
# NATS Server #
Expand Down
1 change: 1 addition & 0 deletions resources/nats/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ global:
# #
####################################
podSecurityContext:
runAsUser: 1000
fsGroup: 10001
seccompProfile:
type: RuntimeDefault
Expand Down
Loading