Merge pull request #36 from jk-cluster/feat/cyberchef-11.4.0

Update cyberchef to 11.4.0

cyberchef/Chart.yaml

@@ -4,8 +4,8 @@ description: A Helm chart to deploy Cyberchef on Kubernetes
 
 type: application
 
-version: 4.1.0+up10.22.1
+version: 5.0.0+up11.4.0
-appVersion: "10.22.1"
+appVersion: "11.4.0"
 
 maintainers:
   - name: jklein

cyberchef/templates/cyberchef.deployment.yaml

@@ -25,14 +25,12 @@ spec:
           securityContext:
             {{- toYaml .Values.cyberchef.securityContext.container | nindent 12 }}
           volumeMounts:
-            # nginx needs writable cache/temp dirs and a writable pid file
+            # nginx-unprivileged keeps its pid file and temp/cache dirs under
-            # location when the root filesystem is read-only.
+            # /tmp, which needs to be writable with a read-only root filesystem.
-            - name: nginx-cache
+            - name: tmp
-              mountPath: /var/cache/nginx
+              mountPath: /tmp
-            - name: nginx-run
-              mountPath: /run
           ports:
-            - containerPort: 80
+            - containerPort: 8080
               protocol: TCP
               name: http
           livenessProbe:
@@ -44,8 +42,6 @@ spec:
           resources:
             {{- include "cyberchef.resources" .Values.cyberchef.resources | nindent 12 }}
       volumes:
-        - name: nginx-cache
+        - name: tmp
-          emptyDir: {}
-        - name: nginx-run
           emptyDir: {}
       restartPolicy: Always

cyberchef/values.yaml

@@ -8,18 +8,14 @@ cyberchef:
   # Replica count for this workload; 0 is allowed and scales it down.
   # The chart-global scaleDown flag takes precedence.
   replicas: 1
-  # The upstream image is stock nginx (root, listening on port 80). To still
+  # Since 11.0.0 the upstream image is nginxinc/nginx-unprivileged: nginx runs
-  # run fully non-root, the pod runs as the image's nginx user (uid 101) and
+  # as its nginx user (uid 101) and listens on the unprivileged port 8080, so
-  # the safe sysctl net.ipv4.ip_unprivileged_port_start=80 lets the unprivileged
+  # no sysctl tweaks are needed to run fully non-root.
-  # nginx bind port 80 without NET_BIND_SERVICE.
   securityContext:
     pod:
       runAsNonRoot: true
       runAsUser: 101
       runAsGroup: 101
-      sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "80"
     container:
       allowPrivilegeEscalation: false
       readOnlyRootFilesystem: true