Skip to content
This repository was archived by the owner on Nov 7, 2025. It is now read-only.

Commit 9949d5e

Browse files
padmankosalarampadmankosalaram
authored
fix: trivy vulnerabilities (#28)
* fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: trivy vulnerabilities * fix: lint
1 parent c57569d commit 9949d5e

File tree

3 files changed

+112
-63
lines changed

3 files changed

+112
-63
lines changed

‎.trivyignore‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,27 @@
1-
KSV001 # "Containers should not run with allowPrivilegeEscalation"
1+
#KSV001 # "Containers should not run with allowPrivilegeEscalation"
22

3-
KSV003 # "The container should drop all default capabilities"
3+
#KSV003 # "The container should drop all default capabilities"
44

5-
KSV011 # "CPU limits should be set"
5+
#KSV011 # "CPU limits should be set"
66

7-
KSV012 # "Container should not be privileged"
7+
#KSV012 # "Container should not be privileged"
88

99
KSV014 # "Use read-only filesystem for containers where possible"
1010

11-
KSV015 # "CPU requests should be set"
11+
#KSV015 # "CPU requests should be set"
1212

13-
KSV016 # "Memory requests should be set"
13+
#KSV016 # "Memory requests should be set"
1414

15-
KSV018 # "Memory limits should be set"
15+
#KSV018 # "Memory limits should be set"
1616

1717
KSV020 # "Force the container to run with user ID > 10000"
1818

1919
KSV021 # "Force the container to run with group ID > 10000"
2020

21-
KSV030 # "Use sefault seccomp"
21+
#KSV030 # "Use sefault seccomp"
2222

23-
KSV104 # "The default namespace should not be used"
23+
#KSV104 # "The default namespace should not be used"
2424

25-
KSV106 # "Container capabilities must only include NET_BIND_SERVICE "
25+
#KSV106 # "Container capabilities must only include NET_BIND_SERVICE "
2626

2727
KSV111 # "Cluster admin role only used where required"

‎chart/deploy-mas/templates/01-deploy-mas.yaml‎

Lines changed: 98 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,25 @@
1+
{{ $ns := printf "mas-%s-pipelines" .Values.mas_instance_id }}
2+
{{ $role_name := "mas-deploy-role" }}
3+
{{ $secret_name := "mas-deploy-secret" }}
4+
{{ $crole_name := "mas-deploy-crole" }}
5+
{{ $sa_name := "mas-deploy-sa" }}
6+
{{ $scc_name := "mas-deploy-scc" }}
7+
{{ $rb_name := "mas-deploy-rb" }}
8+
{{ $crb_name := "mas-deploy-crb" }}
9+
{{ $job_name := "mas-deploy-job" }}
10+
{{ $readonly_root_filesystem := printf "%s" .Values.readonly_root_filesystem }}
111
---
212
apiVersion: v1
313
kind: Namespace
414
metadata:
5-
name: mas-{{ .Values.mas_instance_id }}-pipelines
15+
name: {{ $ns }}
616

717
---
818
kind: Secret
919
apiVersion: v1
1020
metadata:
11-
name: mas-deploy
12-
namespace: mas-{{ .Values.mas_instance_id }}-pipelines
21+
name: {{ $secret_name }}
22+
namespace: {{ $ns }}
1323
data:
1424
entitlement_key: {{ .Values.mas_entitlement_key }}
1525
authorized_entitlement: {{ .Values.mas_license }}
@@ -19,88 +29,112 @@ type: Opaque
1929
apiVersion: v1
2030
kind: ServiceAccount
2131
metadata:
22-
name: sync-sa
23-
namespace: mas-{{ .Values.mas_instance_id }}-pipelines
32+
name: {{ $sa_name }}
33+
namespace: {{ $ns }}
2434

2535
---
26-
kind: ClusterRoleBinding
2736
apiVersion: rbac.authorization.k8s.io/v1
37+
kind: ClusterRoleBinding
2838
metadata:
29-
name: sync-sa
30-
namespace: mas-{{ .Values.mas_instance_id }}-pipelines
31-
subjects:
32-
- kind: ServiceAccount
33-
name: sync-sa
34-
namespace: mas-{{ .Values.mas_instance_id }}-pipelines
39+
name: {{ $crb_name }}
3540
roleRef:
3641
apiGroup: rbac.authorization.k8s.io
3742
kind: ClusterRole
3843
name: cluster-admin
44+
subjects:
45+
- kind: ServiceAccount
46+
name: {{ $sa_name }}
47+
namespace: {{ $ns }}
48+
3949

4050
---
4151
apiVersion: batch/v1
4252
kind: Job
4353
metadata:
44-
name: mas-deploy-sync-role
45-
generateName: "mas-deploy-sync-role-"
46-
namespace: mas-{{ .Values.mas_instance_id }}-pipelines
54+
name: {{ $job_name }}
55+
generateName: "{{ $job_name }}-"
56+
namespace: {{ $ns }}
4757
annotations:
48-
checkov.io/skip1: CKV_K8S_20
49-
checkov.io/skip2: CKV_K8S_37
58+
# checkov.io/skip1: CKV_K8S_20
59+
# checkov.io/skip2: CKV_K8S_37
60+
5061
checkov.io/skip3: CKV_K8S_40
5162
checkov.io/skip4: CKV_K8S_35
52-
checkov.io/skip5: CKV_K8S_43
5363
checkov.io/skip6: CKV_K8S_38
54-
checkov.io/skip7: CKV_K8S_13
55-
checkov.io/skip8: CKV_K8S_11
56-
checkov.io/skip9: CKV_K8S_10
57-
checkov.io/skip10: CKV_K8S_29
58-
checkov.io/skip11: CKV_K8S_28
5964
checkov.io/skip12: CKV_K8S_31
60-
checkov.io/skip13: CKV_K8S_30
61-
checkov.io/skip14: CKV_K8S_12
62-
checkov.io/skip15: CKV_K8S_23
6365
checkov.io/skip16: CKV_K8S_22
66+
67+
# checkov.io/skip5: CKV_K8S_43
68+
# checkov.io/skip10: CKV_K8S_29
69+
70+
71+
# checkov.io/skip7: CKV_K8S_13
72+
# checkov.io/skip8: CKV_K8S_11
73+
# checkov.io/skip9: CKV_K8S_10
74+
75+
# checkov.io/skip11: CKV_K8S_28
76+
77+
# checkov.io/skip13: CKV_K8S_30
78+
# checkov.io/skip14: CKV_K8S_12
79+
# checkov.io/skip15: CKV_K8S_23
80+
81+
6482
spec:
65-
ttlSecondsAfterFinished: 10
83+
ttlSecondsAfterFinished: 120
6684
template:
6785
metadata:
6886
labels:
69-
app: "mas-deploy-job"
87+
app: {{ $job_name }}
7088
spec:
71-
volumes:
72-
#- name: pv-storage
73-
# persistentVolumeClaim:
74-
# claimName: config-pvc
89+
restartPolicy: Never
90+
serviceAccountName: {{ $sa_name }}
91+
securityContext:
92+
runAsNonRoot: true
7593
containers:
76-
- name: mas-deploy
77-
image: quay.io/ibmmas/cli:7.16.0-pre.master
94+
- name: {{ $job_name }}
95+
# 8.0.0-pre.master - sha256:5b5222caecdd860840fd1eb070999e29ed356310474741f76934d0a9f8921d99
96+
# below sha is for quay.io/ibmmas/cli:8.0.0-pre.mascore-2054 (tag 8.0.0), update it once we get a new release tag
97+
image: quay.io/ibmmas/cli@sha256:2e82de3f6bf025ccbecbd9c704bca60f884c7a3cef8211690ebec1ba2ae02791
98+
7899
imagePullPolicy: Always
79-
#volumeMounts:
80-
# - mountPath: "/usr/config-pvc"
81-
# name: pv-storage
100+
securityContext:
101+
readOnlyRootFilesystem: {{ $readonly_root_filesystem }}
102+
runAsNonRoot: true
103+
allowPrivilegeEscalation: false
104+
seccompProfile:
105+
type: RuntimeDefault
106+
capabilities:
107+
drop: ["ALL"]
108+
resources:
109+
limits:
110+
cpu: 200m
111+
memory: 512Mi
112+
requests:
113+
cpu: 10m
114+
memory: 64Mi
82115
command:
83116
- /bin/sh
84117
- -c
85118
- |
86119
87-
88120
set -e
89121
90-
SLS_LICENSE_FILE_LOCAL=/tmp/authorized_entitlement.lic
91-
printf "$AUTHORIZED_ENTITLEMENT\n" > /tmp/authorized_entitlement.lic
92-
echo "------authorized_entitlement.lic--------------"
93-
cat /tmp/authorized_entitlement.lic
94-
echo "------authorized_entitlement.lic--------------"
122+
export ENTITLEMENT_KEY=$(cat /etc/mas/deploy/secrets/entitlement_key)
123+
export AUTHORIZED_ENTITLEMENT=$(cat /etc/mas/deploy/secrets/authorized_entitlement)
124+
##echo "ENTITLEMENT_KEY=${ENTITLEMENT_KEY}"
125+
##echo "AUTHORIZED_ENTITLEMENT=${AUTHORIZED_ENTITLEMENT}"
126+
SLS_LICENSE_FILE_LOCAL=/etc/mas/deploy/secrets/authorized_entitlement
127+
##echo "------authorized_entitlement.lic--------------"
128+
##cat $SLS_LICENSE_FILE_LOCAL
129+
##echo "------authorized_entitlement.lic--------------"
95130
96131
echo "MAS_INSTANCE_ID=${MAS_INSTANCE_ID}"
97132
echo "MAS_WORKSPACE_ID${MAS_WORKSPACE_ID}"
98133
echo "MAS_WORKSPACE_NAME=${MAS_WORKSPACE_NAME}"
99134
echo "MAS_CATALOG_VERSION=${MAS_CATALOG_VERSION}"
100135
echo "MAS_CHANNEL=${MAS_CHANNEL}"
101-
echo "ENTITLEMENT_KEY=${ENTITLEMENT_KEY}"
102136
echo "SLS_LICENSE_ID=${SLS_LICENSE_ID}"
103-
echo "SLS_LICENSE_FILE_LOCAL=${SLS_LICENSE_FILE_LOCAL}"
137+
##echo "SLS_LICENSE_FILE_LOCAL=${SLS_LICENSE_FILE_LOCAL}"
104138
echo "UDS_CONTACT_EMAIL=${UDS_CONTACT_EMAIL}"
105139
echo "UDS_CONTACT_FIRSTNAME=${UDS_CONTACT_FIRSTNAME}"
106140
echo "UDS_CONTACT_LASTNAME=${UDS_CONTACT_LASTNAME}"
@@ -142,7 +176,7 @@ spec:
142176
mas install -i "${MAS_INSTANCE_ID}" -w "${MAS_WORKSPACE_ID}" \
143177
-W "${MAS_WORKSPACE_NAME}" -c "${MAS_CATALOG_VERSION}" \
144178
--mas-channel "${MAS_CHANNEL}" --ibm-entitlement-key ${ENTITLEMENT_KEY} \
145-
--license-id "${SLS_LICENSE_ID}" --license-file ${SLS_LICENSE_FILE_LOCAL} \
179+
--license-id "${SLS_LICENSE_ID}" --license-file "${SLS_LICENSE_FILE_LOCAL}" \
146180
--uds-email "${UDS_CONTACT_EMAIL}" --uds-firstname "${UDS_CONTACT_FIRSTNAME}" \
147181
--uds-lastname "${UDS_CONTACT_LASTNAME}" --storage-rwx "${STORAGE_CLASS_RWX}" --storage-rwo "${STORAGE_CLASS_RWO}" \
148182
--storage-pipeline "${PIPELINE_STORAGE_CLASS}" --storage-accessmode "${PIPELINE_STORAGE_ACCESSMODE}" \
@@ -224,15 +258,29 @@ spec:
224258
- name: ENTITLEMENT_KEY
225259
valueFrom:
226260
secretKeyRef:
227-
name: mas-deploy
261+
name: {{ $secret_name }}
228262
key: entitlement_key
229263

230264
- name: AUTHORIZED_ENTITLEMENT
231265
valueFrom:
232266
secretKeyRef:
233-
name: mas-deploy
267+
name: {{ $secret_name }}
234268
key: authorized_entitlement
235269

236-
restartPolicy: Never
237-
serviceAccountName: sync-sa
270+
volumeMounts:
271+
- name: {{ $secret_name }}
272+
readOnly: true
273+
mountPath: /etc/mas/deploy/secrets
274+
#- mountPath: /opt/app-root/src
275+
# name: app-root-volume
276+
277+
volumes:
278+
- name: {{ $secret_name }}
279+
secret:
280+
secretName: {{ $secret_name }}
281+
defaultMode: 420
282+
optional: false
283+
#- name: app-root-volume
284+
# emptyDir: {}
285+
238286
backoffLimit: 6

‎chart/deploy-mas/values.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@
22
mas_instance_id: inst1
33
mas_workspace_id: wrkid1
44
mas_workspace_name: wrkns1
5-
# catalog which support dro install by default
6-
mas_catalog_version: v8-240227-amd64
5+
# catalog which install dro by default - v8-amd64 , v8-240227-amd64 , v8-240326-amd64 , v8-240405-amd64
6+
mas_catalog_version: v8-240405-amd64
77
mas_channel: 8.11.x
88
sls_license_id: 0242ac110002
99
uds_contact_email: nataraj.s@in.ibm.com
1010
uds_contact_firstname: Nataraj
1111
uds_contact_lastname: Shivashankaraiah
1212
storage_class_rwo: ibmc-vpc-block-retain-10iops-tier
13-
storage_class_rwx: ibmc-vpc-block-retain-10iops-tier
13+
storage_class_rwx: ibmc-vpc-file-dp2
1414
pipeline_storage_class: ibmc-vpc-block-retain-10iops-tier
1515
pipeline_storage_accessmode: ReadWriteOnce
1616
mas_entitlement_key: replace
@@ -31,3 +31,4 @@ db2u_data_storage: 100Gi
3131
db2u_logs_storage: 100Gi
3232
db2u_meta_storage: 20Gi
3333
db2u_temp_storage: 100Gi
34+
readonly_root_filesystem: "false"

0 commit comments

Comments
 (0)