fix: fixes a lot of checkov errors

Sajfer · Oct 18, 2023 · 2b4483d · 2b4483d
1 parent 01d2db7
commit 2b4483d
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 4 deletions.
diff --git a/build/package/Dockerfile b/build/package/Dockerfile
@@ -11,7 +11,7 @@ RUN make
 
 FROM alpine:3.18 as runner
 
-RUN adduser -u 1000 -s /bin/bash --disabled-password surbot && \
+RUN adduser -u 10000 -s /bin/bash --disabled-password surbot && \
   apk add --no-cache \
     ffmpeg \
     curl \

diff --git a/deployments/templates/deployment.yaml b/deployments/templates/deployment.yaml
@@ -2,8 +2,11 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "surbot.fullname" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "surbot.labels" . | nindent 4 }}
+  annotations:
+    checkov.io/skip1: CKV_K8S_43
 spec:
   {{- if not .Values.autoscaling.enabled }}
   replicas: {{ .Values.replicaCount }}
@@ -25,6 +28,7 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "surbot.serviceAccountName" . }}
+      automountServiceAccountToken: false
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:

diff --git a/deployments/templates/serviceaccount.yaml b/deployments/templates/serviceaccount.yaml
@@ -4,6 +4,7 @@ kind: ServiceAccount
 metadata:
   name: {{ include "surbot.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
+  automountServiceAccountToken: false
   labels:
     {{- include "surbot.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}

diff --git a/deployments/values.yaml b/deployments/values.yaml
@@ -6,7 +6,7 @@ replicaCount: 1
 
 image:
   repository: ghcr.io/sajfer/surbot
-  pullPolicy: IfNotPresent
+  pullPolicy: Always
   # Overrides the image tag whose default is the chart appVersion.
   tag: ""
 
@@ -30,7 +30,9 @@ spotify_clientsecret: ""
 
 podAnnotations: {}
 
-podSecurityContext: {}
+podSecurityContext:
+  seccompProfile:
+    type: RuntimeDefault
   # fsGroup: 2000
 
 securityContext:
@@ -39,7 +41,8 @@ securityContext:
     - ALL
   readOnlyRootFilesystem: true
   runAsNonRoot: true
-  runAsUser: 1000
+  runAsUser: 10000
+  allowPrivelegeEscalation: false
 
 resources:
   limits: