Harden the meshcentral chart - #64
Merged
Merged
Conversation
Read-only rootfs and non-root on both meshcentral containers (uid 1000) and on wait-mongodb (uid 999, the mongo image's own user). Uploads and user files have to move off the rootfs for that to work: TMPDIR gets its own emptyDir, and --filespath points at the data volume.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe pull request adds reusable dynamic change detection, matrix-based release and test workflows, hardened Docker and Helm runtime settings, service-account configuration, and updated MeshCentral documentation. ChangesCI change routing
Container and Helm runtime hardening
Project documentation
Estimated code review effort: 4 (Complex) | ~45 minutes Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant ReleaseTest as Release and test workflows
participant Changes as changes.yaml
participant Filter as dorny/paths-filter
participant ImageBuild as Matrix image builds
ReleaseTest->>Changes: Call reusable workflow
Changes->>Filter: Evaluate generated component filters
Filter-->>Changes: Return changed component flags
Changes-->>ReleaseTest: Return images_matrix and changes
ReleaseTest->>ImageBuild: Run changed matrix entries
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/changes.yaml:
- Around line 50-57: Update the path filter in the workflow configuration so
plugin-only changes are included in the image build trigger. In the changes YAML
path list near the existing docker, translate, views, and public globs, add the
plugins glob using the same pattern style so changes under plugins/ are not
skipped by the test and release workflows.
In @.github/workflows/release.yml:
- Around line 179-183: Update the release header generation around IMAGES and
the Helm release reference to include only artifacts built in the current
release: filter images_matrix entries using needs.changes.outputs.changes, and
include the Helm release reference only when the corresponding Helm change flag
is enabled. Preserve the existing image formatting and version tagging for
included entries.
In `@charts/meshcentral/templates/deployment.yaml`:
- Around line 61-64: Update the meshcentral-init command arguments to include
--filespath /opt/mesh/meshcentral-files alongside the existing --datapath
argument, matching the main container configuration. Keep the existing init
behavior and securityContext unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 717760ff-7d48-4a9a-9d81-a4430c331f13
📒 Files selected for processing (8)
.dockerignore.github/workflows/changes.yaml.github/workflows/changes.yml.github/workflows/release.yml.github/workflows/test.ymlcharts/meshcentral/templates/deployment.yamlcharts/meshcentral/values.yamldocker/Dockerfile
💤 Files with no reviewable changes (1)
- .github/workflows/changes.yml
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@charts/meshcentral/templates/_helpers.tpl`:
- Around line 13-15: Update the default branch in the
meshcentral.serviceAccountName helper to derive the ServiceAccount name from the
Helm release identity rather than only .Chart.Name, ensuring separate releases
generate unique names. Preserve the existing .Values.serviceAccount.name
override when explicitly provided.
In `@readme.md`:
- Around line 99-105: The Option 1 installation command installs upstream
MeshCentral without the OpenFrame integration. Update the “Install via npm”
instructions to install the OpenFrame-aware scoped fork package or use a source
install from this repository, ensuring users receive the endpoints implemented
by plugins/openframe.js.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: e2d10f6a-f500-43a0-ad6d-d19d513fcf10
📒 Files selected for processing (11)
.dockerignore.github/workflows/changes.yaml.github/workflows/changes.yml.github/workflows/release.yml.github/workflows/test.ymlcharts/meshcentral/templates/_helpers.tplcharts/meshcentral/templates/deployment.yamlcharts/meshcentral/templates/sa.yamlcharts/meshcentral/values.yamldocker/Dockerfilereadme.md
💤 Files with no reviewable changes (1)
- .github/workflows/changes.yml
🚧 Files skipped from review as they are similar to previous changes (4)
- .dockerignore
- docker/Dockerfile
- charts/meshcentral/templates/deployment.yaml
- charts/meshcentral/values.yaml
ivan-flamingo
approved these changes
Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Read-only rootfs and non-root on the meshcentral containers.
Uploads and user files now go to the data volume.
Summary by CodeRabbit
Security
Deployment
Build and Release
Documentation