From d2528f58bb6f6b3e99d962415ce731e797edb41a Mon Sep 17 00:00:00 2001
From: Marc Burnie <mburnie@amazon.com>
Date: Wed, 28 Sep 2022 16:54:41 +0000
Subject: [PATCH] Checkov Findings and Gitlab Helm Chart Deploy Variables
---
.gitlab-ci.yml | 2 ++
devops/aws/chart/values.yaml | 21 ++++++++++++---------
2 files changed, 14 insertions(+), 9 deletions(-)
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 31840c3b7..723bf760d 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,7 +1,9 @@
variables:
AWS_BUILD_SUBDIR: provider/notification-aws/build-aws
AWS_TEST_SUBDIR: testing/notification-test-aws
+ AWS_CHART_SUBDIR: devops/aws/chart
AWS_SERVICE: notification
+ AWS_SERVICE_GATEWAY: osdu-gateway
AWS_ENVIRONMENT: dev
AWS_DEPLOY_TARGET: EKS
AWS_EKS_DEPLOYMENT_NAME: os-notification
diff --git a/devops/aws/chart/values.yaml b/devops/aws/chart/values.yaml
index cc8209253..b5242dd0f 100644
--- a/devops/aws/chart/values.yaml
+++ b/devops/aws/chart/values.yaml
@@ -1,6 +1,6 @@
# Service Config
image: __CONTAINER__
-imagePullPolicy: IfNotPresent
+imagePullPolicy: Always
service:
type: ClusterIP
port: 8080
@@ -27,7 +27,8 @@ environmentVariables:
value: "http://os-entitlements:8080"
- name: REGISTER_BASE_URL
value: http://os-register:8080
-podAnnotations: {}
+podAnnotations:
+ seccomp.security.alpha.kubernetes.io/pod: "runtime/default"
# Resource Config
replicaCount: 1
@@ -60,13 +61,15 @@ cors:
- Data-Partition-Id
- Correlation-Id
- Content-Type
-securityContext: {}
- # capabilities:
- # drop:
- # - ALL
- # readOnlyRootFilesystem: true
- # runAsNonRoot: true
- # runAsUser: 1000
+securityContext:
+ runAsUser: 10001
+ runAsNonRoot: true
+ readOnlyRootFilesystem: false
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+
allowedPrincipals:
- cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account
- cluster.local/ns/aws-binary-dms/sa/binary-dms
--
GitLab