Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

helm: remove NET_BIND_SERVICE if not needed #5831

Merged
merged 1 commit into from
Jan 6, 2025
Merged

helm: remove NET_BIND_SERVICE if not needed #5831

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,6 @@ spec:
{{- else }}
drop: ["NET_RAW"]
{{- end }}
add: ["NET_BIND_SERVICE"]
containers:
- env:
- name: CLAMD_STARTUP_TIMEOUT
Expand Down Expand Up @@ -92,7 +91,6 @@ spec:
{{- else }}
drop: ["NET_RAW"]
{{- end }}
add: ["NET_BIND_SERVICE"]
volumeMounts:
- mountPath: /var/lib/clamav
subPath: data
Expand Down
2 changes: 0 additions & 2 deletions nextcloud-aio-helm-chart/templates/nextcloud-aio-database-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,6 @@ spec:
{{- else }}
drop: ["NET_RAW"]
{{- end }}
add: ["NET_BIND_SERVICE"]
containers:
- env:
- name: PGTZ
Expand Down Expand Up @@ -93,7 +92,6 @@ spec:
{{- else }}
drop: ["NET_RAW"]
{{- end }}
add: ["NET_BIND_SERVICE"]
volumeMounts:
- mountPath: /var/lib/postgresql/data
subPath: data
Expand Down
2 changes: 0 additions & 2 deletions nextcloud-aio-helm-chart/templates/nextcloud-aio-imaginary-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,4 @@ spec:
{{- else }}
drop: ["NET_RAW"]
{{- end }}
add:
- NET_BIND_SERVICE
{{- end }}
1 change: 0 additions & 1 deletion nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,6 @@ spec:
{{- else }}
drop: ["NET_RAW"]
{{- end }}
add: ["NET_BIND_SERVICE"]
{{- end }} # AIO-config - do not change this comment!
readinessProbe:
exec:
Expand Down
1 change: 0 additions & 1 deletion nextcloud-aio-helm-chart/templates/nextcloud-aio-notify-push-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,6 @@ spec:
{{- else }}
drop: ["NET_RAW"]
{{- end }}
add: ["NET_BIND_SERVICE"]
volumeMounts:
- mountPath: /nextcloud
name: nextcloud-aio-nextcloud
Expand Down
1 change: 0 additions & 1 deletion nextcloud-aio-helm-chart/templates/nextcloud-aio-redis-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,6 @@ spec:
{{- else }}
drop: ["NET_RAW"]
{{- end }}
add: ["NET_BIND_SERVICE"]
volumeMounts:
- mountPath: /data
name: nextcloud-aio-redis
Expand Down
1 change: 0 additions & 1 deletion nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,5 +84,4 @@ spec:
{{- else }}
drop: ["NET_RAW"]
{{- end }}
add: ["NET_BIND_SERVICE"]
{{- end }}
1 change: 0 additions & 1 deletion nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-recording-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,6 @@ spec:
{{- else }}
drop: ["NET_RAW"]
{{- end }}
add: ["NET_BIND_SERVICE"]
volumeMounts:
- mountPath: /tmp
name: nextcloud-aio-talk-recording
Expand Down
1 change: 0 additions & 1 deletion nextcloud-aio-helm-chart/templates/nextcloud-aio-whiteboard-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,5 +74,4 @@ spec:
{{- else }}
drop: ["NET_RAW"]
{{- end }}
add: ["NET_BIND_SERVICE"]
{{- end }}
10 changes: 5 additions & 5 deletions nextcloud-aio-helm-chart/update-helm.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ yq -i 'del(.services.[].tmpfs)' latest.yml
# Remove cap_drop in order to add it later again easier
yq -i 'del(.services.[].cap_drop)' latest.yml
# Remove SYS_NICE for imaginary as it is not supported with RPSS
sed -i "s|- SYS_NICE$|- NET_BIND_SERVICE|" latest.yml
yq -i 'del(.services."nextcloud-aio-imaginary".cap_add)' latest.yml
# cap SYS_ADMIN is called CAP_SYS_ADMIN in k8s
sed -i "s|- SYS_ADMIN$|- CAP_SYS_ADMIN|" latest.yml

Expand Down Expand Up @@ -461,10 +461,9 @@ cat << EOL > /tmp/security.conf
{{- else }}
drop: ["NET_RAW"]
{{- end }}
add: ["NET_BIND_SERVICE"]
EOL
# shellcheck disable=SC1083
find ./ \( -not -name '*collabora-deployment.yaml*' -not -name '*imaginary-deployment.yaml*' -not -name '*onlyoffice-deployment.yaml*' -name "*deployment.yaml" \) -exec sed -i "/^ securityContext:$/r /tmp/security.conf" \{} \;
find ./ \( -not -name '*collabora-deployment.yaml*' -not -name '*apache-deployment.yaml*' -not -name '*onlyoffice-deployment.yaml*' -name "*deployment.yaml" \) -exec sed -i "/^ securityContext:$/r /tmp/security.conf" \{} \;

cat << EOL > /tmp/security.conf
# The items below only work in container context
Expand All @@ -475,9 +474,11 @@ cat << EOL > /tmp/security.conf
{{- else }}
drop: ["NET_RAW"]
{{- end }}
add: ["NET_BIND_SERVICE"]
EOL

# shellcheck disable=SC1083
find ./ -name '*imaginary-deployment.yaml*' -exec sed -i "/^ securityContext:$/r /tmp/security.conf" \{} \;
find ./ -name '*apache-deployment.yaml*' -exec sed -i "/^ securityContext:$/r /tmp/security.conf" \{} \;

cat << EOL > /tmp/security.conf
{{- if eq (.Values.RPSS_ENABLED | default "no") "yes" }} # AIO-config - do not change this comment!
Expand All @@ -490,7 +491,6 @@ cat << EOL > /tmp/security.conf
{{- else }}
drop: ["NET_RAW"]
{{- end }}
add: ["NET_BIND_SERVICE"]
{{- end }} # AIO-config - do not change this comment!
EOL
# shellcheck disable=SC1083
Expand Down