fix: sets correct permissions for the non-root user

fonoster · Jun 20, 2023 · d0db749 · d0db749
1 parent 7203af9
commit d0db749
Show file tree

Hide file tree

Showing 6 changed files with 41 additions and 6 deletions.
diff --git a/mods/pgdata/Dockerfile b/mods/pgdata/Dockerfile
@@ -13,6 +13,7 @@ WORKDIR /scripts
 COPY .scripts/generate-certs.sh /generate-certs.sh
 COPY mods/pgdata .
 
+# Todo: We need to normalize user id and group id across all images
 RUN chmod +x /generate-certs.sh \
   && apk add --no-cache openssl git tini nodejs npm python3 make cmake g++ \
   && npm pack \
@@ -22,7 +23,12 @@ RUN chmod +x /generate-certs.sh \
   && npx prisma generate \
   && ln -s /usr/local/bin/run_pgdata /usr/local/bin/run \
   && apk del git python3 make cmake g++ npm \
-  && rm -rf /scripts /var/cache/apk/* /tmp/* /var/tmp/*
+  && mkdir -p $PATH_TO_CERTS \
+  && chown -R 1000:3000 $PATH_TO_CERTS \
+  && chmod 700 $PATH_TO_CERTS \
+  && rm -rf /scripts /var/cache/apk/* /tmp/* /var/tmp/* 
+
+USER 1000:3000
 
 # Re-mapping the signal from 143 to 0
 ENTRYPOINT ["tini", "-v", "-e", "143", "--"]

diff --git a/ops/charts/connect/Chart.yaml b/ops/charts/connect/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: routr-connect
 description: Routr Connect Helm Chart
 type: application
-version: 0.1.5
-appVersion: 2.1.2
+version: 0.1.6
+appVersion: 2.1.3
 dependencies:
   - name: postgresql
     version: 12.1.15

diff --git a/ops/charts/connect/templates/NOTES.txt b/ops/charts/connect/templates/NOTES.txt
@@ -1 +1 @@
-1. Get the application URL by running these commands:
+Success!
diff --git a/ops/charts/connect/templates/apiserver/deployment.yaml b/ops/charts/connect/templates/apiserver/deployment.yaml
@@ -25,6 +25,17 @@ spec:
         runAsUser: {{ .Values.apiserver.securityContext.runAsUser }}
         runAsGroup: {{ .Values.apiserver.securityContext.runAsGroup }}
         fsGroup: {{ .Values.apiserver.securityContext.fsGroup }}
+      initContainers:
+        - name: wait-for-database
+          image: "{{ .Values.apiserver.migrationsImage.repository }}:{{ .Values.apiserver.migrationsImage.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.apiserver.migrationsImage.pullPolicy }}
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              until pg_isready -h {{ .Release.Name }}-postgresql.{{ .Release.Namespace }} -p 5432 -U {{ .Values.postgresql.auth.username }} >/dev/null 2>&1; do
+                echo "Waiting for the database..."
+                sleep 2
+              done
       containers:
         - name: apiserver
           image: "{{ .Values.apiserver.image.repository }}:{{ .Values.apiserver.image.tag | default .Chart.AppVersion }}"
@@ -47,6 +58,8 @@ spec:
               value: {{ .Values.global.otlExporter }}
           ports:
             - containerPort: 51907
+            # External port for the API server
+            - containerPort: 51908
           resources:
             {{- if .Values.apiserver.resources.limits }}
             limits:

diff --git a/ops/charts/connect/templates/apiserver/migration.yaml b/ops/charts/connect/templates/apiserver/migration.yaml
@@ -8,6 +8,17 @@ metadata:
     "helm.sh/hook": post-install,post-upgrade
     "helm.sh/hook-delete-policy": hook-succeeded
 spec:
+  initContainers:
+    - name: wait-for-database
+      image: "{{ .Values.apiserver.migrationsImage.repository }}:{{ .Values.apiserver.migrationsImage.tag | default .Chart.AppVersion }}"
+      imagePullPolicy: {{ .Values.apiserver.migrationsImage.pullPolicy }}
+      command: ["/bin/sh", "-c"]
+      args:
+        - |
+          until pg_isready -h {{ .Release.Name }}-postgresql.{{ .Release.Namespace }} -p 5432 -U {{ .Values.postgresql.auth.username }} >/dev/null 2>&1; do
+            echo "Waiting for the database..."
+            sleep 2
+          done
   containers:
     - name: migrations
       image: "{{ .Values.apiserver.migrationsImage.repository }}:{{ .Values.apiserver.migrationsImage.tag | default .Chart.AppVersion }}"
@@ -17,4 +28,4 @@ spec:
             name: {{ .Release.Name }}-routr-database-url
   restartPolicy: Never
   terminationGracePeriodSeconds: 0
-{{- end }}
+{{- end }}
diff --git a/ops/charts/connect/templates/apiserver/service.yaml b/ops/charts/connect/templates/apiserver/service.yaml
@@ -12,8 +12,13 @@ metadata:
     service: apiserver
 spec:
   ports:
-  - port: 51907
+  - name: internal
+    port: 51907
     targetPort: 51907
+  # External secure port
+  - name: external
+    port: 51908
+    targetPort: 51908
   selector:
     {{- include ".helm.selectorLabels" . | nindent 4 }}
     service: apiserver