jklein
69111ae470
- Add securityContext.pod/container values with hardened defaults; the dockur/samba image requires root and a writable root filesystem, so the remaining deviations from the baseline are documented in values.yaml (caps reduced to CHOWN, DAC_OVERRIDE, FOWNER, NET_BIND_SERVICE, SETGID, SETUID; allowPrivilegeEscalation: false) - Make the NodePorts configurable (samba.smbNodePort/netbiosNodePort, defaults 30445/30139 as published before) - Rename secrets.sambaUsersRef to secrets.sambaUsersSecretRef (breaking) - Rename the ConfigMap from -config-cfm to -configmap - Add the tpl-rendered env value convention (value, secretKeyRef, configMapKeyRef forms) - Fix the CI users.conf fixture to the username:uid:groupname:gid:password format the pinned image actually parses - Bump chart to 4.0.0+up4.23.10 Part of #32
87 lines
2.9 KiB
YAML
87 lines
2.9 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
secrets:
|
|
sambaUsersSecretRef: null
|
|
|
|
samba:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
# NodePorts the SMB service is published on (service type NodePort).
|
|
smbNodePort: 30445
|
|
netbiosNodePort: 30139
|
|
shares:
|
|
- name: null
|
|
validUsers: null
|
|
description: null
|
|
size: null
|
|
# Extra environment variables for the samba container. Values are rendered
|
|
# through tpl; value, secretKeyRef and configMapKeyRef forms are supported.
|
|
env: []
|
|
# SMB is not an HTTP protocol, so probe the main SMB TCP port.
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: 445
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 445
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
# The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
|
|
startupProbe:
|
|
tcpSocket:
|
|
port: 445
|
|
periodSeconds: 5
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
memory: 50Mi
|
|
cpu: 0.1
|
|
ephemeralStorage: 50Mi
|
|
|
|
# Deviations from the repo's hardening baseline, forced by the
|
|
# ghcr.io/dockur/samba image (its entrypoint samba.sh):
|
|
# - no runAsNonRoot: the entrypoint creates the Unix users from users.conf
|
|
# (groupadd/adduser/usermod) and smbd impersonates the authenticated
|
|
# share user per session, both of which require starting as root.
|
|
# - readOnlyRootFilesystem: false: the entrypoint writes to the root
|
|
# filesystem at startup (/etc/passwd + /etc/group for user creation,
|
|
# the /etc/samba.conf healthcheck symlink, mkdir /shared and the Samba
|
|
# TDB databases under /var/lib/samba).
|
|
# - capabilities: ALL dropped except what a multi-user root file server
|
|
# needs: NET_BIND_SERVICE (ports 445/139), SETUID/SETGID (per-session
|
|
# user impersonation), CHOWN/FOWNER/DAC_OVERRIDE (managing share files
|
|
# on behalf of the users).
|
|
securityContext:
|
|
pod:
|
|
fsGroup: 1000
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
add:
|
|
- CHOWN
|
|
- DAC_OVERRIDE
|
|
- FOWNER
|
|
- NET_BIND_SERVICE
|
|
- SETGID
|
|
- SETUID
|
|
|
|
globalConfig: null
|
|
storageClass: longhorn
|