Skip to content

Commit 63b21e0

Browse files
danc094codetogetherdanc094codetogether
committed
Testing
1 parent 73f0459 commit 63b21e0

4 files changed

Lines changed: 3 additions & 202 deletions

File tree

‎charts/collab/templates/deployment.yaml‎

Lines changed: 1 addition & 101 deletions
Original file line numberDiff line numberDiff line change
@@ -29,101 +29,6 @@ spec:
2929
- name: {{ include "codetogether.fullname" . }}-pull-secret
3030
{{- end }}
3131
serviceAccountName: {{ include "codetogether.serviceAccountName" . }}
32-
{{- if .Values.openshift.enabled }}
33-
# OpenShift
34-
{{- else if .Values.podSecurityContext }}
35-
# Vanilla Kubernetes use what is set in podSecurityContext
36-
securityContext:
37-
{{- toYaml .Values.podSecurityContext | nindent 8 }}
38-
{{- end }}
39-
{{- if .Values.securityContext.readOnlyRootFilesystem }}
40-
initContainers:
41-
- name: prepare-volatile
42-
image: busybox:1.36
43-
command: ["/bin/sh", "-c"]
44-
args:
45-
{{- if .Values.openshift.enabled }}
46-
- |
47-
set -eu
48-
for d in \
49-
/run/volatile/clients \
50-
/run/volatile/codetogether-config \
51-
/run/volatile/codetogether-forever \
52-
/run/volatile/codetogether-npm \
53-
/run/volatile/codetogether-pm2 \
54-
/run/volatile/codetogether-theia \
55-
/run/volatile/jicofo-etc \
56-
/run/volatile/jvb-etc \
57-
/run/volatile/log-codetogether \
58-
/run/volatile/log-jitsi \
59-
/run/volatile/log-prosody \
60-
/run/volatile/meet-web \
61-
/run/volatile/nginx \
62-
/run/volatile/pki-catrust \
63-
/run/volatile/prosody \
64-
/run/volatile/prosody-certs \
65-
/run/volatile/prosody-conf \
66-
/run/volatile/var-cache/dnf \
67-
/run/volatile/var-cache/ldconfig \
68-
/run/volatile/var-cache/libX11 \
69-
/run/volatile/var-cache/nginx \
70-
/run/volatile/var-cache/private \
71-
/run/volatile/var-cache/yum
72-
do
73-
install -d -m 0775 "$d"
74-
done
75-
{{- else }}
76-
- |
77-
set -eu
78-
for d in \
79-
/run/volatile/clients \
80-
/run/volatile/codetogether-config \
81-
/run/volatile/codetogether-forever \
82-
/run/volatile/codetogether-npm \
83-
/run/volatile/codetogether-pm2 \
84-
/run/volatile/codetogether-theia \
85-
/run/volatile/jicofo-etc \
86-
/run/volatile/jvb-etc \
87-
/run/volatile/log-codetogether \
88-
/run/volatile/log-jitsi \
89-
/run/volatile/log-prosody \
90-
/run/volatile/meet-web \
91-
/run/volatile/nginx \
92-
/run/volatile/pki-catrust \
93-
/run/volatile/prosody \
94-
/run/volatile/prosody-certs \
95-
/run/volatile/prosody-conf \
96-
/run/volatile/var-cache/dnf \
97-
/run/volatile/var-cache/ldconfig \
98-
/run/volatile/var-cache/libX11 \
99-
/run/volatile/var-cache/nginx \
100-
/run/volatile/var-cache/private \
101-
/run/volatile/var-cache/yum
102-
do
103-
install -d -m 0775 "$d"
104-
done
105-
chown -R {{ default 1000 .Values.securityContext.runAsUser }}:{{ default 1000 .Values.securityContext.runAsGroup | default 1000 }} \
106-
/run /var/log/nginx /var/cache/nginx
107-
{{- end }}
108-
securityContext:
109-
{{- if .Values.openshift.enabled }}
110-
runAsNonRoot: true
111-
allowPrivilegeEscalation: false
112-
{{- else }}
113-
runAsUser: 0
114-
runAsGroup: 0
115-
runAsNonRoot: false
116-
allowPrivilegeEscalation: false
117-
{{- end }}
118-
volumeMounts:
119-
- name: codetogether-runtime
120-
mountPath: /run
121-
- name: codetogether-runtime
122-
mountPath: /var/log/nginx
123-
- name: codetogether-runtime
124-
mountPath: /var/cache/nginx
125-
{{- end }}
126-
12732
containers:
12833
- name: {{ .Chart.Name }}
12934
securityContext:
@@ -289,10 +194,6 @@ spec:
289194
name: codetogether-runtime
290195
- mountPath: /tmp
291196
name: codetogether-tmp
292-
- mountPath: /var/log/nginx
293-
name: codetogether-runtime
294-
- mountPath: /var/cache/nginx
295-
name: codetogether-runtime
296197
{{- if .Values.favicon.enabled }}
297198
- mountPath: /opt/volatile-template/nginx/favicon.ico
298199
name: favicon-volume
@@ -349,8 +250,7 @@ spec:
349250
- name: codetogether-runtime
350251
emptyDir: {}
351252
- name: codetogether-tmp
352-
emptyDir:
353-
medium: Memory
253+
emptyDir: {}
354254
{{- else if .Values.favicon.enabled }}
355255
volumes:
356256
- name: favicon-volume

‎charts/collab/values.yaml‎

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -211,24 +211,14 @@ serviceAccount:
211211

212212
podAnnotations: {}
213213

214-
# Enable if deploying in OpenShift
215-
openshift:
216-
enabled: false
217-
218214
securityContext: {} #defaults
219215
# capabilities:
220216
# drop:
221217
# - ALL
222218
# readOnlyRootFilesystem: true # enable for read-only setup
223219
# runAsNonRoot: true
224220
# runAsUser: 1000 # Use '0' for root user, in vanilla k8s you can use any non-root uid
225-
# runAsGroup: 1000
226-
# In openshift, dont set runAsUser or runAsGroup, let OpenShift assign the values
227-
228-
podSecurityContext: {}
229-
# In OpenShift will inject automatically
230-
#fsGroup: 1000
231-
#fsGroupChangePolicy: "OnRootMismatch"
221+
# In openshift, dont set runAsUser, let OpenShift assign the values
232222

233223
readinessProbe:
234224
initialDelaySeconds: 60

‎charts/intel/templates/deployment.yaml‎

Lines changed: 0 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -27,56 +27,6 @@ spec:
2727
- name: {{ include "codetogether.fullname" . }}-pull-secret
2828
{{- end }}
2929
serviceAccountName: {{ include "codetogether.serviceAccountName" . }}
30-
{{- if .Values.openshift.enabled }}
31-
# OpenShift
32-
{{- else if .Values.podSecurityContext }}
33-
securityContext:
34-
{{- toYaml .Values.podSecurityContext | nindent 8 }}
35-
{{- end }}
36-
{{- if .Values.securityContext.readOnlyRootFilesystem }}
37-
initContainers:
38-
- name: prepare-runtime
39-
image: busybox:1.36
40-
command: ["/bin/sh","-c"]
41-
args:
42-
{{- if .Values.openshift.enabled }}
43-
- |
44-
set -eu
45-
umask 002
46-
for d in \
47-
/var/log/nginx \
48-
/var/cache/nginx
49-
do
50-
install -d -m 2775 "$d"
51-
done
52-
{{- else }}
53-
- |
54-
set -eu
55-
for d in \
56-
/run \
57-
/var/log/nginx \
58-
/var/cache/nginx
59-
do
60-
install -d -m 0775 "$d"
61-
done
62-
chown -R {{ default 1000 .Values.securityContext.runAsUser }}:{{ default 1000 .Values.securityContext.runAsGroup | default 1000 }} \
63-
/run /var/log/nginx /var/cache/nginx
64-
{{- end }}
65-
securityContext:
66-
{{- if .Values.openshift.enabled }}
67-
runAsNonRoot: true
68-
allowPrivilegeEscalation: false
69-
{{- else }}
70-
runAsUser: 0
71-
runAsGroup: 0
72-
runAsNonRoot: false
73-
allowPrivilegeEscalation: false
74-
{{- end }}
75-
volumeMounts:
76-
- { name: codetogether-runtime, mountPath: /run }
77-
- { name: codetogether-runtime, mountPath: /var/log/nginx }
78-
- { name: codetogether-runtime, mountPath: /var/cache/nginx }
79-
{{- end }}
8030
containers:
8131
- name: {{ .Chart.Name }}
8232
securityContext:
@@ -149,26 +99,6 @@ spec:
14999
key: apiKey
150100
{{- end }}
151101
{{- end }}
152-
{{- if .Values.securityContext.readOnlyRootFilesystem }}
153-
volumeMounts:
154-
- name: properties-volume
155-
mountPath: /opt/codetogether/runtime/cthq.properties
156-
subPath: cthq.properties
157-
{{- if .Values.java.customCacerts.enabled }}
158-
- name: java-cacerts
159-
mountPath: /etc/ssl/certs/java/cacerts
160-
subPath: cacerts
161-
{{- end }}
162-
# Read-only root FS mounts
163-
- mountPath: /run
164-
name: codetogether-runtime
165-
- mountPath: /tmp
166-
name: codetogether-tmp
167-
- mountPath: /var/log/nginx
168-
name: codetogether-runtime
169-
- mountPath: /var/cache/nginx
170-
name: codetogether-runtime
171-
{{- else }}
172102
volumeMounts:
173103
- name: properties-volume
174104
mountPath: /opt/codetogether/runtime/cthq.properties
@@ -178,7 +108,6 @@ spec:
178108
mountPath: /etc/ssl/certs/java/cacerts
179109
subPath: cacerts
180110
{{- end }}
181-
{{- end }}
182111
ports:
183112
- name: http
184113
containerPort: 1080
@@ -227,14 +156,6 @@ spec:
227156
secret:
228157
secretName: {{ .Values.java.customCacerts.cacertsSecretName }}
229158
{{- end }}
230-
{{- if .Values.securityContext.readOnlyRootFilesystem }}
231-
- name: codetogether-runtime
232-
emptyDir: {}
233-
- name: codetogether-tmp
234-
emptyDir:
235-
medium: Memory
236-
{{- end }}
237-
238159
{{- with .Values.nodeSelector }}
239160
nodeSelector:
240161
{{- toYaml . | nindent 8 }}

‎charts/intel/values.yaml‎

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -132,24 +132,14 @@ serviceAccount:
132132

133133
podAnnotations: {}
134134

135-
# Enable if deploying in OpenShift
136-
openshift:
137-
enabled: false
138-
139135
securityContext: {} #defaults
140136
# capabilities:
141137
# drop:
142138
# - ALL
143139
# readOnlyRootFilesystem: true # enable for read-only setup
144140
# runAsNonRoot: true
145141
# runAsUser: 1000 # Use '0' for root user
146-
# runAsGroup: 1000
147-
# In openshift, dont set runAsUser or runAsGroup, let OpenShift assign the values
148-
149-
podSecurityContext: {}
150-
# In OpenShift will inject automatically
151-
#fsGroup: 1000
152-
#fsGroupChangePolicy: "OnRootMismatch"
142+
# In openshift, dont set runAsUser, let OpenShift assign the values
153143

154144
ai:
155145
enabled: false

0 commit comments

Comments
 (0)