Fix terraria chart + read only root file system for terre

Cybermaxke · Oct 18, 2021 · 58ff75c · 58ff75c
1 parent af11a70
commit 58ff75c
Show file tree

Hide file tree

Showing 5 changed files with 17 additions and 6 deletions.
diff --git a/charts/terraria/Chart.yaml b/charts/terraria/Chart.yaml
@@ -2,6 +2,6 @@ apiVersion: v2
 name: terraria
 description: A Helm chart for Terraria
 type: application
-version: 0.1.6
+version: 0.1.7
 appVersion: "1.4.2.3"
 icon: https://terraria.org/static/media/logo.734118ae.png
diff --git a/charts/terraria/templates/serviceaccount.yaml b/charts/terraria/templates/serviceaccount.yaml
@@ -6,4 +6,8 @@ metadata:
   {{- include "terraria.namespace" . | nindent 2 }}
   labels:
     {{- include "terraria.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 {{- end }}
diff --git a/charts/terraria/values.yaml b/charts/terraria/values.yaml
@@ -389,9 +389,12 @@ rbac:
   # Specifies whether RBAC resources should be created
   create: true
 
+# Service account
 serviceAccount:
-  # Specifies whether a ServiceAccount should be created
+  # Specifies whether a service account should be created
   create: true
-  # The name of the ServiceAccount to use
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
   # If not set and create is true, a name is generated using the fullname template
-  name: null
+  name: ""
diff --git a/charts/terre/Chart.yaml b/charts/terre/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: terre
 description: A Helm chart for Terre
 type: application
-version: 0.1.0
+version: 0.1.1
 appVersion: "latest"
diff --git a/charts/terre/templates/deployment.yaml b/charts/terre/templates/deployment.yaml
@@ -24,6 +24,8 @@ spec:
         runAsGroup: 1000
         fsGroup: 1000
       volumes:
+        - name: tmp
+          emptyDir: {}
         - name: logs
           emptyDir: {}
         - name: plugins
@@ -43,10 +45,12 @@ spec:
           securityContext:
             runAsNonRoot: true
             allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
+            readOnlyRootFilesystem: true
           image: "{{ tpl .Values.image.terre.repository . }}:{{ tpl .Values.image.terre.tag . }}"
           imagePullPolicy: {{ default .Values.image.pullPolicy .Values.image.terre.pullPolicy }}
           volumeMounts:
+            - name: tmp
+              mountPath: /tmp
             - name: logs
               mountPath: /logs
             - name: plugins