fix: set fsGroup for correct mount group

steadybit · Feb 6, 2024 · e2d5851 · e2d5851
1 parent 36cf5af
commit e2d5851
Show file tree

Hide file tree

Showing 5 changed files with 91 additions and 55 deletions.
diff --git a/charts/steadybit-agent/tests/__snapshot__/statefulset_auth_test.yaml.snap b/charts/steadybit-agent/tests/__snapshot__/statefulset_auth_test.yaml.snap
@@ -107,14 +107,16 @@ using oauth2 with mtls from containerPath and token uri:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-agent
                   name: steadybit-agent-state
                 - mountPath: /tmp
                   name: tmp-dir
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-agent
           volumes:
             - emptyDir:
@@ -247,9 +249,6 @@ using oauth2 with mtls from secrets:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-agent
                   name: steadybit-agent-state
@@ -261,6 +260,11 @@ using oauth2 with mtls from secrets:
                 - mountPath: /opt/steadybit/agent/etc/oauth2/server
                   name: oauth2-tls-server
                   readOnly: true
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-agent
           volumes:
             - emptyDir:

diff --git a/charts/steadybit-agent/tests/__snapshot__/statefulset_test.yaml.snap b/charts/steadybit-agent/tests/__snapshot__/statefulset_test.yaml.snap
@@ -112,14 +112,16 @@ manifest should match snapshot:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-agent
                   name: steadybit-agent-state
                 - mountPath: /tmp
                   name: tmp-dir
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-agent
           volumes:
             - emptyDir:
@@ -252,14 +254,16 @@ should add aws account id from values:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-agent
                   name: steadybit-agent-state
                 - mountPath: /tmp
                   name: tmp-dir
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-agent
           volumes:
             - emptyDir:
@@ -406,14 +410,16 @@ should add match labels:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-agent
                   name: steadybit-agent-state
                 - mountPath: /tmp
                   name: tmp-dir
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-agent
           volumes:
             - emptyDir:
@@ -545,14 +551,16 @@ should apply extra pod labels:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-agent
                   name: steadybit-agent-state
                 - mountPath: /tmp
                   name: tmp-dir
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-agent
           volumes:
             - emptyDir:
@@ -699,14 +707,16 @@ using extensions with mtls from containerpath:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-agent
                   name: steadybit-agent-state
                 - mountPath: /tmp
                   name: tmp-dir
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-agent
           volumes:
             - emptyDir:
@@ -848,9 +858,6 @@ using extensions with mtls from secrets:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-agent
                   name: steadybit-agent-state
@@ -864,6 +871,11 @@ using extensions with mtls from secrets:
                   readOnly: true
                 - mountPath: /opt/steadybit/agent/etc/extra-certs
                   name: extra-certs
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-agent
           volumes:
             - emptyDir:
@@ -997,16 +1009,18 @@ using image pull secrets with debug json log:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-agent
                   name: steadybit-agent-state
                 - mountPath: /tmp
                   name: tmp-dir
           imagePullSecrets:
             - name: test-pull-secret
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-agent
           volumes:
             - emptyDir:

diff --git a/charts/steadybit-outpost/Chart.yaml b/charts/steadybit-outpost/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: steadybit-outpost
 description: steadybit outpost Helm chart for Kubernetes.
-version: 1.2.13:
+version: 1.2.13
 appVersion: 1.0.108
 home: https://www.steadybit.com/
 icon: https://steadybit-website-assets.s3.amazonaws.com/logo-symbol-transparent.png

diff --git a/charts/steadybit-outpost/tests/__snapshot__/statefulset_auth_test.yaml.snap b/charts/steadybit-outpost/tests/__snapshot__/statefulset_auth_test.yaml.snap
@@ -107,14 +107,16 @@ using oauth2 with mtls from containerPath and token uri:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-outpost
                   name: steadybit-outpost-state
                 - mountPath: /tmp
                   name: tmp-dir
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-outpost
           volumes:
             - emptyDir:
@@ -247,9 +249,6 @@ using oauth2 with mtls from secrets:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-outpost
                   name: steadybit-outpost-state
@@ -261,6 +260,11 @@ using oauth2 with mtls from secrets:
                 - mountPath: /opt/steadybit/agent/etc/oauth2/server
                   name: oauth2-tls-server
                   readOnly: true
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-outpost
           volumes:
             - emptyDir:

diff --git a/charts/steadybit-outpost/tests/__snapshot__/statefulset_test.yaml.snap b/charts/steadybit-outpost/tests/__snapshot__/statefulset_test.yaml.snap
@@ -112,14 +112,16 @@ manifest should match snapshot:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-outpost
                   name: steadybit-outpost-state
                 - mountPath: /tmp
                   name: tmp-dir
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-outpost
           volumes:
             - emptyDir:
@@ -252,14 +254,16 @@ should add aws account id from values:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-outpost
                   name: steadybit-outpost-state
                 - mountPath: /tmp
                   name: tmp-dir
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-outpost
           volumes:
             - emptyDir:
@@ -406,14 +410,16 @@ should add match labels:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-outpost
                   name: steadybit-outpost-state
                 - mountPath: /tmp
                   name: tmp-dir
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-outpost
           volumes:
             - emptyDir:
@@ -545,14 +551,16 @@ should apply extra pod labels:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-outpost
                   name: steadybit-outpost-state
                 - mountPath: /tmp
                   name: tmp-dir
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-outpost
           volumes:
             - emptyDir:
@@ -699,14 +707,16 @@ using extensions with mtls from containerpath:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-outpost
                   name: steadybit-outpost-state
                 - mountPath: /tmp
                   name: tmp-dir
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-outpost
           volumes:
             - emptyDir:
@@ -848,9 +858,6 @@ using extensions with mtls from secrets:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-outpost
                   name: steadybit-outpost-state
@@ -864,6 +871,11 @@ using extensions with mtls from secrets:
                   readOnly: true
                 - mountPath: /opt/steadybit/outpost/etc/extra-certs
                   name: extra-certs
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-outpost
           volumes:
             - emptyDir:
@@ -997,16 +1009,18 @@ using image pull secrets with debug json log:
                   drop:
                     - ALL
                 readOnlyRootFilesystem: true
-                runAsGroup: 1000
-                runAsNonRoot: true
-                runAsUser: 1000
               volumeMounts:
                 - mountPath: /var/lib/steadybit-outpost
                   name: steadybit-outpost-state
                 - mountPath: /tmp
                   name: tmp-dir
           imagePullSecrets:
             - name: test-pull-secret
+          securityContext:
+            fsGroup: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            runAsUser: 1000
           serviceAccountName: steadybit-outpost
           volumes:
             - emptyDir: