jfrog / charts

JFrog official Helm Charts
https://jfrog.com/integration/helm-repository/
Apache License 2.0
259 stars 448 forks source link

[jfrog-platform] Added podSecurityContext and containerSecurityContext for pre-upgrade-check migration hook container #1929

Closed mrarends closed 4 weeks ago

mrarends commented 1 month ago

PR Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

What this PR does / why we need it: The new pre-upgrade-check pod and container is missing the option to set security context settings. On clusters that require more strict settings the pre-upgrade-check can not be started:

violates PodSecurity'

    (combined from similar events): Error creating: pods "jfrog-platform-pre-upgrade-check-j527c" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "pre-upgrade-check" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "pre-upgrade-check" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "pre-upgrade-check" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "pre-upgrade-check" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

Special notes for your reviewer:

oumkale commented 1 month ago

HI @mrarends,

Thank you so much for your efforts :partying_face::partying_face:. We will review this internally and update you once the release is out.