add pod securitycontext to auth proxy (#187)

Signed-off-by: André Bauer <[email protected]>
kokuwaio · Jun 27, 2024 · 26d33c1 · 26d33c1
1 parent 8e7b2c6
commit 26d33c1
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 1 deletion.
diff --git a/charts/visual-regression-tracker/Chart.yaml b/charts/visual-regression-tracker/Chart.yaml
@@ -6,7 +6,7 @@ sources:
   - https://github.com/Visual-Regression-Tracker/Visual-Regression-Tracker
   - https://github.com/kokuwaio/helm-charts/tree/main/charts/visual-regression-tracker
 type: application
-version: 4.0.0
+version: 4.0.1
 appVersion: "5.0.4"
 maintainers:
   - name: monotek

diff --git a/charts/visual-regression-tracker/templates/auth-proxy-deployment.yaml b/charts/visual-regression-tracker/templates/auth-proxy-deployment.yaml
@@ -82,6 +82,8 @@ spec:
               mountPath: /etc/nginx/conf.d/default.conf
               subPath: default.conf
               readOnly: true
+      securityContext:
+        {{- toYaml .Values.authProxy.podSecurityContext | nindent 8 }}
       volumes:
         - name: tmpdir
           emptyDir:

diff --git a/charts/visual-regression-tracker/values.yaml b/charts/visual-regression-tracker/values.yaml
@@ -58,6 +58,14 @@ authProxy:
 
   podLabels: {}
 
+  podSecurityContext:
+    fsGroup: 101
+    runAsGroup: 101
+    runAsNonRoot: true
+    runAsUser: 101
+    seccompProfile:
+      type: RuntimeDefault
+
   resources: {}
     # We usually recommend not to specify default resources and to leave this as a conscious
     # choice for the user. This also increases chances charts run on environments with little