eightball/all-in-one
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2025-12-19 22:16:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

Revert "helm: add a default for RPSS_ENABLED"

Browse source
This commit is contained in:
Simon L. 2024-11-26 11:08:55 +01:00 • committed by GitHub
parent e74436c3c1
commit b1353d309e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
11 changed files with 30 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nextcloud-aio-helm-chart/templates/nextcloud-aio-apache-deployment.yaml
View file

@ -31,7 +31,7 @@ spec:
runAsUser: 33 runAsUser: 33
runAsGroup: 33 runAsGroup: 33
runAsNonRoot: true runAsNonRoot: true
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
{{- end }} {{- end }}
@ -74,7 +74,7 @@ spec:
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]

6
nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-deployment.yaml
View file

@ -32,7 +32,7 @@ spec:
runAsUser: 100 runAsUser: 100
runAsGroup: 100 runAsGroup: 100
runAsNonRoot: true runAsNonRoot: true
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
{{- end }} {{- end }}
@ -50,7 +50,7 @@ spec:
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]
@ -73,7 +73,7 @@ spec:
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]

6
nextcloud-aio-helm-chart/templates/nextcloud-aio-database-deployment.yaml
View file

@ -31,7 +31,7 @@ spec:
runAsUser: 999 runAsUser: 999
runAsGroup: 999 runAsGroup: 999
runAsNonRoot: true runAsNonRoot: true
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
{{- end }} {{- end }}
@ -49,7 +49,7 @@ spec:
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]
@ -76,7 +76,7 @@ spec:
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]

4
nextcloud-aio-helm-chart/templates/nextcloud-aio-imaginary-deployment.yaml
View file

@ -30,7 +30,7 @@ spec:
runAsUser: 65534 runAsUser: 65534
runAsGroup: 65534 runAsGroup: 65534
runAsNonRoot: true runAsNonRoot: true
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
{{- end }} {{- end }}
@ -49,7 +49,7 @@ spec:
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]

8
nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml
View file

@ -23,7 +23,7 @@ spec:
labels: labels:
io.kompose.service: nextcloud-aio-nextcloud io.kompose.service: nextcloud-aio-nextcloud
spec: spec:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} # AIO-config - do not change this comment! {{- if eq .Values.RPSS_ENABLED "yes" }} # AIO-config - do not change this comment!
securityContext: securityContext:
# The items below only work in pod context # The items below only work in pod context
fsGroup: 33 fsGroup: 33
@ -32,7 +32,7 @@ spec:
runAsUser: 33 runAsUser: 33
runAsGroup: 33 runAsGroup: 33
runAsNonRoot: true runAsNonRoot: true
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
{{- end }} {{- end }}
@ -179,12 +179,12 @@ spec:
- name: WHITEBOARD_SECRET - name: WHITEBOARD_SECRET
value: "{{ .Values.WHITEBOARD_SECRET }}" value: "{{ .Values.WHITEBOARD_SECRET }}"
image: nextcloud/aio-nextcloud:20241125_091756 image: nextcloud/aio-nextcloud:20241125_091756
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} # AIO-config - do not change this comment! {{- if eq .Values.RPSS_ENABLED "yes" }} # AIO-config - do not change this comment!
securityContext: securityContext:
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]

4
nextcloud-aio-helm-chart/templates/nextcloud-aio-notify-push-deployment.yaml
View file

@ -31,7 +31,7 @@ spec:
runAsUser: 33 runAsUser: 33
runAsGroup: 33 runAsGroup: 33
runAsNonRoot: true runAsNonRoot: true
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
{{- end }} {{- end }}
@ -64,7 +64,7 @@ spec:
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]

4
nextcloud-aio-helm-chart/templates/nextcloud-aio-redis-deployment.yaml
View file

@ -31,7 +31,7 @@ spec:
runAsUser: 999 runAsUser: 999
runAsGroup: 999 runAsGroup: 999
runAsNonRoot: true runAsNonRoot: true
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
{{- end }} {{- end }}
@ -50,7 +50,7 @@ spec:
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]

4
nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-deployment.yaml
View file

@ -30,7 +30,7 @@ spec:
runAsUser: 1000 runAsUser: 1000
runAsGroup: 1000 runAsGroup: 1000
runAsNonRoot: true runAsNonRoot: true
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
{{- end }} {{- end }}
@ -67,7 +67,7 @@ spec:
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]

4
nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-recording-deployment.yaml
View file

@ -32,7 +32,7 @@ spec:
runAsUser: 122 runAsUser: 122
runAsGroup: 122 runAsGroup: 122
runAsNonRoot: true runAsNonRoot: true
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
{{- end }} {{- end }}
@ -55,7 +55,7 @@ spec:
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]

4
nextcloud-aio-helm-chart/templates/nextcloud-aio-whiteboard-deployment.yaml
View file

@ -30,7 +30,7 @@ spec:
runAsUser: 65534 runAsUser: 65534
runAsGroup: 65534 runAsGroup: 65534
runAsNonRoot: true runAsNonRoot: true
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
{{- end }} {{- end }}
@ -57,7 +57,7 @@ spec:
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]

12
nextcloud-aio-helm-chart/update-helm.sh
View file

@ -158,7 +158,7 @@ for variable in "${DEPLOYMENTS[@]}"; do
if echo "$variable" | grep -q "nextcloud-deployment.yaml"; then if echo "$variable" | grep -q "nextcloud-deployment.yaml"; then
USER=33 USER=33
GROUP=33 GROUP=33
echo ' {{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} # AIO-config - do not change this comment!' > /tmp/pod.securityContext echo ' {{- if eq .Values.RPSS_ENABLED "yes" }} # AIO-config - do not change this comment!' > /tmp/pod.securityContext
else else
USER="$(grep runAsUser "$variable" | grep -oP '[0-9]+')" USER="$(grep runAsUser "$variable" | grep -oP '[0-9]+')"
GROUP="$USER" GROUP="$USER"
@ -176,7 +176,7 @@ for variable in "${DEPLOYMENTS[@]}"; do
runAsUser: $USER runAsUser: $USER
runAsGroup: $GROUP runAsGroup: $GROUP
runAsNonRoot: true runAsNonRoot: true
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
{{- end }} {{- end }}
@ -446,7 +446,7 @@ cat << EOL > /tmp/security.conf
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]
@ -460,7 +460,7 @@ cat << EOL > /tmp/security.conf
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]
@ -470,12 +470,12 @@ EOL
find ./ -name '*imaginary-deployment.yaml*' -exec sed -i "/^ securityContext:$/r /tmp/security.conf" \{} \; find ./ -name '*imaginary-deployment.yaml*' -exec sed -i "/^ securityContext:$/r /tmp/security.conf" \{} \;
cat << EOL > /tmp/security.conf cat << EOL > /tmp/security.conf
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} # AIO-config - do not change this comment! {{- if eq .Values.RPSS_ENABLED "yes" }} # AIO-config - do not change this comment!
securityContext: securityContext:
# The items below only work in container context # The items below only work in container context
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
{{- if eq .Values.RPSS_ENABLED "yes" | default "no" }} {{- if eq .Values.RPSS_ENABLED "yes" }}
drop: ["ALL"] drop: ["ALL"]
{{- else }} {{- else }}
drop: ["NET_RAW"] drop: ["NET_RAW"]