Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

added the user and set the necessary permissions #2167

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

added the user and set the necessary permissions #2167

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c45df33
added the user and set the necessory permissions
rock-007 Jul 24, 2024
c7326f5
Trigger build with /gcbrun
rock-007 Jul 25, 2024
b344a3b
Added the logic to create user & group only if it doesnt exist
rock-007 Jul 25, 2024
0434a42
removing the conditional check as postgres user already exist
rock-007 Jul 26, 2024
462e875
added the security context for the non root user
rock-007 Jul 28, 2024
6080e4a
added the missing security contexts in the K8s file
rock-007 Jul 28, 2024
e7adf61
Fix up security contexts
bourgeoisor Jul 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions kubernetes-manifests/ledger-db.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,11 @@ spec:
- mountPath: /var/lib/postgresql/data
name: postgresdb
subPath: postgres
securityContext:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a start but it's also missing security contexts to prevent all access to root:

        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
              - all
          privileged: false
          readOnlyRootFilesystem: true

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have added these now to the ledger-db.yaml file.

fsGroup: 1000
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
serviceAccount: bank-of-anthos
serviceAccountName: default
volumes:
Expand Down
6 changes: 6 additions & 0 deletions src/ledger/ledger-db/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,12 @@ FROM postgres:16.3-alpine@sha256:de3d7b6e4b5b3fe899e997579d6dfe95a99539d154abe03
# Need to get coreutils to get the date bash function working properly:
RUN apk add --no-cache coreutils && rm -rf /var/cache/apk/*

# Change ownership of the necessary directories
RUN chown -R postgres:postgres /var/lib/postgresql /var/run/postgresql

# Set thte correct permissions
RUN chmod -R 0700 /var/lib/postgresql/data && chmod -R 0755 /var/run/postgresql
Comment on lines +19 to +23
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mathieu-benoit do you think that's all that was needed? Seems too good to be true but maybe I'm overthinking it


# Files for initializing the database.
COPY initdb/0_init_tables.sql initdb/1_create_transactions.sh /docker-entrypoint-initdb.d/
RUN chmod 755 /docker-entrypoint-initdb.d/0_init_tables.sql /docker-entrypoint-initdb.d/1_create_transactions.sh