fluxcd
/
source-controller
mirror of https://github.com/fluxcd/source-controller.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #285 from fluxcd/fsGroup 

Add fsGroup to pod security context
This commit is contained in:
Stefan Prodan 2021-02-08 11:38:20 +02:00 committed by GitHub
parent 0465b122e5 9764598125
commit a55a7141ab
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Dockerfile
View File

@ -29,7 +29,7 @@ COPY internal/ internal/
# build without specifing the arch # build without specifing the arch
RUN CGO_ENABLED=1 go build -o source-controller main.go RUN CGO_ENABLED=1 go build -o source-controller main.go
FROM alpine:3.12 FROM alpine:3.13
# link repo to the GitHub Container Registry image # link repo to the GitHub Container Registry image
LABEL org.opencontainers.image.source="https://github.com/fluxcd/source-controller" LABEL org.opencontainers.image.source="https://github.com/fluxcd/source-controller"
@ -44,7 +44,7 @@ COPY --from=builder /workspace/source-controller /usr/local/bin/
# https://github.com/gliderlabs/docker-alpine/issues/367#issuecomment-354316460 # https://github.com/gliderlabs/docker-alpine/issues/367#issuecomment-354316460
RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
RUN addgroup -S controller && adduser -S -g controller controller RUN addgroup -S controller && adduser -S controller -G controller
USER controller USER controller

4
config/manager/deployment.yaml
View File

@ -20,6 +20,10 @@ spec:
prometheus.io/port: "8080" prometheus.io/port: "8080"
spec: spec:
terminationGracePeriodSeconds: 10 terminationGracePeriodSeconds: 10
# Required for AWS IAM Role bindings
# https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html
securityContext:
fsGroup: 1337
containers: containers:
- name: manager - name: manager
image: fluxcd/source-controller image: fluxcd/source-controller