diff --git a/helm/coder/tests/chart_test.go b/helm/coder/tests/chart_test.go
index 6c0b181a30550..22a392810d6c6 100644
--- a/helm/coder/tests/chart_test.go
+++ b/helm/coder/tests/chart_test.go
@@ -108,6 +108,10 @@ var testCases = []testCase{
name: "svc_loadbalancer",
expectedError: "",
},
+ {
+ name: "securitycontext",
+ expectedError: "",
+ },
}
type testCase struct {
diff --git a/helm/coder/tests/testdata/securitycontext.golden b/helm/coder/tests/testdata/securitycontext.golden
new file mode 100644
index 0000000000000..a29a1e9ec7c54
--- /dev/null
+++ b/helm/coder/tests/testdata/securitycontext.golden
@@ -0,0 +1,193 @@
+---
+# Source: coder/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ annotations: {}
+ labels:
+ app.kubernetes.io/instance: release-name
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: coder
+ app.kubernetes.io/part-of: coder
+ app.kubernetes.io/version: 0.1.0
+ helm.sh/chart: coder-0.1.0
+ name: coder
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ name: coder-workspace-perms
+rules:
+ - apiGroups: [""]
+ resources: ["pods"]
+ verbs:
+ - create
+ - delete
+ - deletecollection
+ - get
+ - list
+ - patch
+ - update
+ - watch
+ - apiGroups: [""]
+ resources: ["persistentvolumeclaims"]
+ verbs:
+ - create
+ - delete
+ - deletecollection
+ - get
+ - list
+ - patch
+ - update
+ - watch
+ - apiGroups:
+ - apps
+ resources:
+ - deployments
+ verbs:
+ - create
+ - delete
+ - deletecollection
+ - get
+ - list
+ - patch
+ - update
+ - watch
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: "coder"
+subjects:
+ - kind: ServiceAccount
+ name: "coder"
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ name: coder-workspace-perms
+---
+# Source: coder/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+ name: coder
+ labels:
+ helm.sh/chart: coder-0.1.0
+ app.kubernetes.io/name: coder
+ app.kubernetes.io/instance: release-name
+ app.kubernetes.io/part-of: coder
+ app.kubernetes.io/version: "0.1.0"
+ app.kubernetes.io/managed-by: Helm
+ annotations:
+ {}
+spec:
+ type: LoadBalancer
+ sessionAffinity: None
+ ports:
+ - name: "http"
+ port: 80
+ targetPort: "http"
+ protocol: TCP
+ nodePort:
+ externalTrafficPolicy: "Cluster"
+ selector:
+ app.kubernetes.io/name: coder
+ app.kubernetes.io/instance: release-name
+---
+# Source: coder/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ annotations: {}
+ labels:
+ app.kubernetes.io/instance: release-name
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: coder
+ app.kubernetes.io/part-of: coder
+ app.kubernetes.io/version: 0.1.0
+ helm.sh/chart: coder-0.1.0
+ name: coder
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app.kubernetes.io/instance: release-name
+ app.kubernetes.io/name: coder
+ template:
+ metadata:
+ annotations: {}
+ labels:
+ app.kubernetes.io/instance: release-name
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: coder
+ app.kubernetes.io/part-of: coder
+ app.kubernetes.io/version: 0.1.0
+ helm.sh/chart: coder-0.1.0
+ spec:
+ affinity:
+ podAntiAffinity:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ - podAffinityTerm:
+ labelSelector:
+ matchExpressions:
+ - key: app.kubernetes.io/instance
+ operator: In
+ values:
+ - coder
+ topologyKey: kubernetes.io/hostname
+ weight: 1
+ containers:
+ - args:
+ - server
+ command:
+ - /opt/coder
+ env:
+ - name: CODER_HTTP_ADDRESS
+ value: 0.0.0.0:8080
+ - name: CODER_PROMETHEUS_ADDRESS
+ value: 0.0.0.0:2112
+ - name: CODER_ACCESS_URL
+ value: http://coder.default.svc.cluster.local
+ - name: KUBE_POD_IP
+ valueFrom:
+ fieldRef:
+ fieldPath: status.podIP
+ - name: CODER_DERP_SERVER_RELAY_URL
+ value: http://$(KUBE_POD_IP):8080
+ image: ghcr.io/coder/coder:latest
+ imagePullPolicy: IfNotPresent
+ lifecycle: {}
+ livenessProbe:
+ httpGet:
+ path: /healthz
+ port: http
+ scheme: HTTP
+ name: coder
+ ports:
+ - containerPort: 8080
+ name: http
+ protocol: TCP
+ readinessProbe:
+ httpGet:
+ path: /healthz
+ port: http
+ scheme: HTTP
+ resources: {}
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ readOnlyRootFilesystem: null
+ runAsGroup: 1000
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
+ volumeMounts: []
+ restartPolicy: Always
+ serviceAccountName: coder
+ terminationGracePeriodSeconds: 60
+ volumes: []
diff --git a/helm/coder/tests/testdata/securitycontext.yaml b/helm/coder/tests/testdata/securitycontext.yaml
new file mode 100644
index 0000000000000..bcc6594111c97
--- /dev/null
+++ b/helm/coder/tests/testdata/securitycontext.yaml
@@ -0,0 +1,8 @@
+coder:
+ image:
+ tag: latest
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
pFad - Phonifier reborn
Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.
Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.
Alternative Proxies:
Alternative Proxy
pFad Proxy
pFad v3 Proxy
pFad v4 Proxy