Specify runAsNonRoot in daemon-set manifests
#3925
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
6 tasks
sigv
force-pushed
the
daemonsetRunAsNonRoot
branch
2 times, most recently
from
e99ad53 to
a46303e
Compare
lucacome
approved these changes
May 23, 2023
Codecov Report
@@ Coverage Diff @@
## main #3925 +/- ##
==========================================
- Coverage 51.82% 51.79% -0.04%
==========================================
Files 59 59
Lines 16697 16697
==========================================
- Hits 8654 8648 -6
- Misses 7745 7749 +4
- Partials 298 300 +2 see 2 files with indirect coverage changes 📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
sigv
force-pushed
the
daemonsetRunAsNonRoot
branch
6 times, most recently
from
a798d23 to
bd617ab
Compare
This is a no-op change. It aligns the `daemon-set` manifests to match the `deployment` manifests. Both of these currently specify an explicit user ID to run as, therefore the container is guaranteed to be run as non-root. This `runAsNonRoot: true` instruction would come in as important if the chart no longer specifies `runAsUser`, and someone is packaging their own image without a USER directive in the Dockerfile. Removing the `runAsUser` parameter could be useful as to allow OpenShift to override the UID, in a later change.
sigv
force-pushed
the
daemonsetRunAsNonRoot
branch
from
bd617ab to
d5670d9
Compare
|
@lucacome, would it be possible to have a second set of eyes on this PR, so it's not stuck with a partial review? 👀🤞🏻 |
vepatel
approved these changes
May 30, 2023
haywoodsh
approved these changes
May 30, 2023
lucacome
added
the
enhancement
|
Thank you! 🙏🏻 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed changes
This is a no-op change. It aligns the
daemon-setmanifests to match thedeploymentmanifests. Both of these currently specify an explicit user ID to run as, therefore the container is guaranteed to be run as non-root.This
runAsNonRoot: trueinstruction would come in as important if the chart no longer specifiesrunAsUser, and someone is packaging their own image without a USER directive in the Dockerfile. Removing therunAsUserparameter could be useful as to allow OpenShift to override the UID, in a later change.This PR aligns the
deployments/daemon-set/files to match all following related files:deployments/deployment/nginx-ingress.yamldeployments/deployment/nginx-plus-ingress.yamldeployments/helm-chart/templates/controller-daemonset.yamldeployments/helm-chart/templates/controller-deployment.yamlChecklist
Before creating a PR, run through this checklist and mark each as complete.