From 3164343440ca92290213bbd09c41312508ad00d9 Mon Sep 17 00:00:00 2001 From: "Simon L." Date: Mon, 6 Jan 2025 14:00:35 +0100 Subject: [PATCH] helm: remove NET_BIND_SERVICE if not needed Signed-off-by: Simon L. --- .../templates/nextcloud-aio-nextcloud-deployment.yaml | 2 +- nextcloud-aio-helm-chart/update-helm.sh | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml index 2ee12d00c4f..2f757a60e20 100755 --- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml +++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml @@ -180,7 +180,7 @@ spec: value: "{{ .Values.WHITEBOARD_ENABLED }}" - name: WHITEBOARD_SECRET value: "{{ .Values.WHITEBOARD_SECRET }}" - image: nextcloud/aio-nextcloud:20250106_094420 + image: nextcloud/aio-nextcloud:20250106_09442 {{- if eq (.Values.RPSS_ENABLED | default "no") "yes" }} # AIO-config - do not change this comment! securityContext: # The items below only work in container context diff --git a/nextcloud-aio-helm-chart/update-helm.sh b/nextcloud-aio-helm-chart/update-helm.sh index 7e1364b2ebc..e975a6d0669 100755 --- a/nextcloud-aio-helm-chart/update-helm.sh +++ b/nextcloud-aio-helm-chart/update-helm.sh @@ -55,7 +55,7 @@ yq -i 'del(.services.[].tmpfs)' latest.yml # Remove cap_drop in order to add it later again easier yq -i 'del(.services.[].cap_drop)' latest.yml # Remove SYS_NICE for imaginary as it is not supported with RPSS -sed -i "s|- SYS_NICE$|- NET_BIND_SERVICE|" latest.yml +sed -i "/- SYS_NICE$/d" latest.yml # cap SYS_ADMIN is called CAP_SYS_ADMIN in k8s sed -i "s|- SYS_ADMIN$|- CAP_SYS_ADMIN|" latest.yml @@ -461,10 +461,9 @@ cat << EOL > /tmp/security.conf {{- else }} drop: ["NET_RAW"] {{- end }} - add: ["NET_BIND_SERVICE"] EOL # shellcheck disable=SC1083 -find ./ \( -not -name '*collabora-deployment.yaml*' -not -name '*imaginary-deployment.yaml*' -not -name '*onlyoffice-deployment.yaml*' -name "*deployment.yaml" \) -exec sed -i "/^ securityContext:$/r /tmp/security.conf" \{} \; +find ./ \( -not -name '*collabora-deployment.yaml*' -not -name '*apache-deployment.yaml*' -not -name '*onlyoffice-deployment.yaml*' -name "*deployment.yaml" \) -exec sed -i "/^ securityContext:$/r /tmp/security.conf" \{} \; cat << EOL > /tmp/security.conf # The items below only work in container context @@ -475,9 +474,11 @@ cat << EOL > /tmp/security.conf {{- else }} drop: ["NET_RAW"] {{- end }} + add: ["NET_BIND_SERVICE"] EOL + # shellcheck disable=SC1083 -find ./ -name '*imaginary-deployment.yaml*' -exec sed -i "/^ securityContext:$/r /tmp/security.conf" \{} \; +find ./ -name '*apache-deployment.yaml*' -exec sed -i "/^ securityContext:$/r /tmp/security.conf" \{} \; cat << EOL > /tmp/security.conf {{- if eq (.Values.RPSS_ENABLED | default "no") "yes" }} # AIO-config - do not change this comment! @@ -490,7 +491,6 @@ cat << EOL > /tmp/security.conf {{- else }} drop: ["NET_RAW"] {{- end }} - add: ["NET_BIND_SERVICE"] {{- end }} # AIO-config - do not change this comment! EOL # shellcheck disable=SC1083