chore(deps): update docker.io/datashield/rock-base:6.3.1 docker diges…

…t to d8940f1 (#447) * chore(deps): update docker.io/datashield/rock-base:6.3.1 docker digest to d8940f1 * updated uid * docs --------- Co-authored-by: miracum-renovate[bot] <184965040+miracum-renovate[bot]@users.noreply.github.com> Co-authored-by: chgl <[email protected]>
miracum · Jan 20, 2025 · e8ec229 · e8ec229
1 parent 89c7826
commit e8ec229
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 7 deletions.
diff --git a/charts/datashield/Chart.yaml b/charts/datashield/Chart.yaml
@@ -23,7 +23,7 @@ dependencies:
     version: 2.29.0
 deprecated: false
 kubeVersion: ">= 1.19.0"
-version: 0.7.62
+version: 0.7.63
 annotations:
   artifacthub.io/license: Apache-2.0
   artifacthub.io/containsSecurityUpdates: "false"
@@ -37,4 +37,4 @@ annotations:
     # When using the list of objects option the valid supported kinds are
     # added, changed, deprecated, removed, fixed and security.
     - kind: changed
-      description: "Updated docker.io/library/busybox to sha256:f1a295688a1cad4f66e7f45484a882a8b45fbdea28fa0a889ac17146775ad1a2"
+      description: "Updated docker.io/datashield/rock-base to sha256:d8940f175aef3b20fcf715bc4038c03c653736329ae1f71579f93530d811d328"
diff --git a/charts/datashield/README.md b/charts/datashield/README.md
@@ -97,7 +97,7 @@ helm install --create-namespace -n datashield datashield oci://ghcr.io/miracum/c
 | rock.persistence.selector                        | object | `{}`                                                                                                                                            | selector to match an existing Persistent Volume (this value is evaluated as a template) selector: matchLabels: app: my-app                                                                                                                                                                                                                    |
 | rock.persistence.size                            | string | `"8Gi"`                                                                                                                                         | PVC Storage Request for volume                                                                                                                                                                                                                                                                                                                |
 | rock.persistence.storageClass                    | string | `""`                                                                                                                                            | PVC Storage Class for data volume If defined, storageClassName: <storageClass> If set to "-", storageClassName: "", which disables dynamic provisioning If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner.                                                                         |
-| rock.podSecurityContext                          | object | `{"fsGroup":65534,"runAsNonRoot":true}`                                                                                                         | pod security context                                                                                                                                                                                                                                                                                                                          |
+| rock.podSecurityContext                          | object | `{"fsGroup":10041,"fsGroupChangePolicy":"OnRootMismatch","runAsNonRoot":true}`                                                                  | pod security context                                                                                                                                                                                                                                                                                                                          |
 | rock.replicaCount                                | int    | `1`                                                                                                                                             | number of rock instances in the cluster                                                                                                                                                                                                                                                                                                       |
 | rock.resources                                   | object | `{}`                                                                                                                                            | resource limits and requests                                                                                                                                                                                                                                                                                                                  |
 | rock.resourcesPreset                             | string | `"small"`                                                                                                                                       | set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if primary.resources is set (primary.resources is recommended for production). More information: <https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15> |

diff --git a/charts/datashield/values.yaml b/charts/datashield/values.yaml
@@ -241,7 +241,7 @@ rock:
   image:
     registry: docker.io
     repository: datashield/rock-base
-    tag: 6.3.1@sha256:ee04ae43894d8f78ee4c173c0cc474f7b7e823c8fa707ed0a1822ec9ef7e8108
+    tag: 6.3.1@sha256:d8940f175aef3b20fcf715bc4038c03c653736329ae1f71579f93530d811d328
     pullPolicy: IfNotPresent
 
   # -- rock cluster name. Evaluated as a template
@@ -342,15 +342,16 @@ rock:
       drop:
         - ALL
     runAsNonRoot: true
-    runAsUser: 101
-    runAsGroup: 65534
+    runAsUser: 10041
+    runAsGroup: 10041
     seccompProfile:
       type: RuntimeDefault
 
   # -- pod security context
   podSecurityContext:
     runAsNonRoot: true
-    fsGroup: 65534
+    fsGroup: 10041
+    fsGroupChangePolicy: "OnRootMismatch"
 
   # -- pod node selector
   nodeSelector: {}