add security context that we recommend for the image

[elrido]

This is an untested change, that I hope will not break any existing setup. I would expect that k8s does run the process as specified in the container with the non-root user ID already and therefore the data gets owned accordingly, but as discussed in #31 it could be made explicit.

[bdashrad]

I will review and test this tomorrow at work

[bdashrad]

We may want to consider wrapping the securityContext block in a conditional, default off for now, until we release a version tagged docker image to reduce risk of hitting any edge cases.

We also should make this change to the StatefulSet

[elrido]

Ok, I've created a tag "1.3.4-alpine3.12-k8s-sec-context" on the image repo, which got auto-built and published to the docker hub. Would I now need to change the Chart.yaml's appversion to this tag or would you prefer to have the conditional in place anyway?

helm-chart/privatebin/Chart.yaml

Line 3 in 109a3c5

appVersion: 1.3.4

[bdashrad]

I need to think about how to do this properly in the stateful set so we don't break anyone using persistent volumes for storage.

[elrido]

Yes, lets better be careful with this change.

Don't know if this is helpful or not: For that k8s setup with an NFS backed persistent volume I had to use an init container in the deployment to set up the permissions (as in the example for the image's README). Maybe if it got used to recursively update the permissions?

      initContainers:
      - name: {{ .Chart.Name }}-permissions
        image: privatebin/chown:1.31.1-musl-1.1.24-r9
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        command: ['-R', '65534:82', '/mnt']
        securityContext:
          runAsUser: 0
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /mnt
          name: storage
          readOnly: False

Note: The image mentioned above contains only the chown binary built from busybox.

[bdashrad]

That seems to be the common way to deal with file permissions in this situation. For example: https://github.com/helm/charts/blob/master/stable/redis/templates/redis-master-statefulset.yaml#L317

[Punkoivan]

Hello there.
I would add fsGroup and set to 82.
Without this it breaks on EKS with gp2 as PV and StatefulSet as a kind.

Also ReadWriteMany is not allowed mode within gp2, so made it as a variable in values.
Submitted PR #37
Would be happy to adjust that to fit this one.

Thanks!