feat(voucher-vault): fixed security-policies

voucher-vault/Chart.yaml

@@ -4,7 +4,7 @@ description: A Helm chart to deploy VoucherVault on Kubernetes
 
 type: application
 
-version: 1.2.0+up1.27.4
+version: 1.3.0+up1.27.4
 appVersion: "1.27.4"
 
 maintainers:

voucher-vault/templates/voucher-vault.sfs.yaml

@@ -46,12 +46,18 @@ spec:
             {{- end }}
           ports:
             {{- toYaml .Values.voucherVault.ports | nindent 12 }}
+          {{- if .Values.voucherVault.livenessProbe }}
           livenessProbe:
             {{- toYaml .Values.voucherVault.livenessProbe | nindent 12 }}
+          {{- end }}
+          {{- if .Values.voucherVault.readinessProbe }}
           readinessProbe:
             {{- toYaml .Values.voucherVault.readinessProbe | nindent 12 }}
+          {{- end }}
+          {{- if .Values.voucherVault.startupProbe }}
           startupProbe:
             {{- toYaml .Values.voucherVault.startupProbe | nindent 12 }}
+          {{- end }}
           resources:
             {{- toYaml .Values.voucherVault.resources | nindent 12 }}
           securityContext:

voucher-vault/values.yaml

@@ -14,45 +14,19 @@ voucherVault:
       memory: 384Mi
       ephemeral-storage: 100Mi
   # TODO: Refine liness, readiness, startup probes
-  livenessProbe:
+  livenessProbe: null
-    httpGet:
+  readinessProbe: null
-      path: /
+  startupProbe: null
-      port: http
-    initialDelaySeconds: 10
-    periodSeconds: 10
-    timeoutSeconds: 5
-    failureThreshold: 3
-  readinessProbe:
-    httpGet:
-      path: /
-      port: http
-    initialDelaySeconds: 10
-    periodSeconds: 10
-    timeoutSeconds: 5
-    failureThreshold: 3
-  startupProbe:
-    httpGet:
-      path: /
-      port: http
-    initialDelaySeconds: 30
-    periodSeconds: 10
-    timeoutSeconds: 5
-    failureThreshold: 3
   securityContext:
     pod:
       runAsNonRoot: true
-      runAsUser: 20000
+      runAsUser: 33
-      runAsGroup: 1000
+      runAsGroup: 33
-      fsGroup: 1000
+      fsGroup: 33
       fsGroupChangePolicy: Always
     container:
       allowPrivilegeEscalation: false
-      readOnlyRootFilesystem: true
       runAsNonRoot: true
-      capabilities:
-        drop:
-          - ALL
-        add: []
   ports:
     - containerPort: 8000
       protocol: TCP