Change deployment group for run in Kubernetes

.prettierignore

@@ -0,0 +1 @@
+charts/**/*

Dockerfile

@@ -344,7 +344,16 @@ RUN mamba install --yes \
 RUN echo 'export PATH=/opt/conda/bin:$PATH' >> /home/jovyan/.bashrc
 RUN pip install opentelemetry-exporter-prometheus-remote-write
 
-RUN chgrp -Rf root /home/$NB_USER && chmod -Rf g+w /home/$NB_USER
+RUN chown -R ${NB_UID}:${NB_GID} /home/${NB_USER} && \
+    chmod 1775 /home/${NB_USER} && \
+    find /home/${NB_USER} -type f -exec chmod 0444 {} \; && \
+    find /home/${NB_USER} -type d -exec chmod 0775 {} \;
+
+# Set permissions for 10001 User and 0 Group (openshift case)
+RUN chown -R 10001:0 /home/${NB_USER} && \
+    chmod 1775 /home/${NB_USER}  && \
+    find /home/${NB_USER} -type f -exec chmod 0444 {} \; && \
+    find /home/${NB_USER} -type d -exec chmod 0775 {} \;
 
 # Switch back to jovyan to avoid accidental container runs as root
 USER ${NB_UID}

charts/env-checker/templates/ConfigMap.yaml

@@ -1,4 +1,3 @@
----
 kind: ConfigMap
 apiVersion: v1
 metadata:

charts/env-checker/templates/CronJob.yaml

@@ -1,6 +1,5 @@
-#Creation CronJob if ENVIRONMENT_CHECKER_CRON_JOB_COMMAND filled
----
 {{- if .Values.ENVIRONMENT_CHECKER_CRON_JOB_COMMAND }}
+---
 kind: CronJob
 apiVersion: batch/v1
 metadata:
@@ -24,7 +23,7 @@ spec:
           containers:
             - name: '{{ printf "%s-cronjob" .Values.SERVICE_NAME }}'
               image: {{ template "env-checker.image" . }}
-              command: [ "/bin/sh", "-c", "$(ENVIRONMENT_CHECKER_CRON_JOB_COMMAND)" ]
+              command: ["/bin/sh", "-c", "$(ENVIRONMENT_CHECKER_CRON_JOB_COMMAND)"]
               env:
                 - name: "ENVIRONMENT_CHECKER_CRON_JOB_COMMAND"
                   value: '{{ .Values.ENVIRONMENT_CHECKER_CRON_JOB_COMMAND }}'
@@ -34,9 +33,8 @@ spec:
               resources:
                 {{- include "envchecker.pod.resources" . | nindent 16 }}
           {{- include "envchecker.pod.volumes" . | nindent 10 }}
-        {{ with .Values.NODE_SELECTOR_LABELS }}
-        nodeSelector:
-          {{ toYaml . | nindent 10 }}
-        {{ end }}
-
+          {{ with .Values.NODE_SELECTOR_LABELS }}
+          nodeSelector:
+            {{ toYaml . | nindent 10 }}
+          {{ end }}
 {{- end }}

charts/env-checker/templates/Deployment.yaml

@@ -1,4 +1,3 @@
-# Building Deployment in case it is: dev, qa, pre-prod and other non prod environments
 kind: Deployment
 apiVersion: apps/v1
 metadata:
@@ -18,27 +17,27 @@ spec:
   revisionHistoryLimit: {{ .Values.RC_REVISIONS }}
   strategy:
     {{- if eq (default "" .Values.DEPLOYMENT_STRATEGY_TYPE) "recreate" }}
-      type: Recreate
+    type: Recreate
     {{- else if eq (default "" .Values.DEPLOYMENT_STRATEGY_TYPE) "best_effort_controlled_rollout" }}
-      type: RollingUpdate
-      rollingUpdate:
-        maxSurge: 0
-        maxUnavailable: 80%
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 80%
     {{- else if eq (default "" .Values.DEPLOYMENT_STRATEGY_TYPE) "ramped_slow_rollout" }}
-      type: RollingUpdate
-      rollingUpdate:
-        maxSurge: 1
-        maxUnavailable: 0
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
     {{- else if eq (default "" .Values.DEPLOYMENT_STRATEGY_TYPE) "custom_rollout" }}
-      type: RollingUpdate
-      rollingUpdate:
-        maxSurge: {{ .Values.DEPLOYMENT_STRATEGY_MAXSURGE | default "25%" }}
-        maxUnavailable: {{ .Values.DEPLOYMENT_STRATEGY_MAXUNAVAILABLE | default "25%" }}
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: {{ .Values.DEPLOYMENT_STRATEGY_MAXSURGE | default "25%" }}
+      maxUnavailable: {{ .Values.DEPLOYMENT_STRATEGY_MAXUNAVAILABLE | default "25%" }}
     {{- else }}
-      type: RollingUpdate
-      rollingUpdate:
-        maxSurge: 25%
-        maxUnavailable: 25%
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
     {{- end }}
   template:
     metadata:
@@ -71,7 +70,6 @@ spec:
             {{- include "envchecker.pod.volumeMounts" . | nindent 12 }}
           resources:
             {{- include "envchecker.pod.resources" . | nindent 12 }}
-          {{- if eq (default false .Values.ENVIRONMENT_CHECKER_SELF_CHECK_ENABLED) false }}
           readinessProbe:
             tcpSocket:
               port: web
@@ -84,11 +82,11 @@ spec:
             initialDelaySeconds: 10
             periodSeconds: 10
             timeoutSeconds: 5
-          {{- end }}
           securityContext:
-          {{ if eq .Values.PAAS_PLATFORM "Kubernetes" }}
-            runAsGroup: 10001
-          {{ end }}
+            {{- if eq .Values.PAAS_PLATFORM "KUBERNETES" }}
+            runAsUser: 1000
+            runAsGroup: 1000
+            {{- end }}
             readOnlyRootFilesystem: {{ .Values.READONLY_CONTAINER_FILE_SYSTEM_ENABLED }}
             runAsNonRoot: true
             seccompProfile:
@@ -97,7 +95,7 @@ spec:
             capabilities:
               drop:
                 - ALL
-       {{- include "envchecker.pod.volumes" . | nindent 6 }}
+      {{- include "envchecker.pod.volumes" . | nindent 6 }}
     {{ with .Values.NODE_SELECTOR_LABELS }}
     nodeSelector:
       {{ toYaml . | nindent 8 }}

charts/env-checker/templates/Service.yaml

@@ -1,4 +1,5 @@
-{{ if not .Values.PRODUCTION_MODE }}
+{{- if not .Values.PRODUCTION_MODE }}
+---
 kind: Service
 apiVersion: v1
 metadata:
@@ -26,4 +27,4 @@ spec:
     {{- end }}
   selector:
     name: '{{ .Values.SERVICE_NAME }}'
-{{ end }}
+{{- end }}

charts/env-checker/templates/UiAccessTokenSecret.yaml

@@ -8,8 +8,8 @@ metadata:
     app.kubernetes.io/managed-by: '{{ .Values.MANAGED_BY }}'
 type: Opaque
 stringData:
-{{- if .Values.ENVIRONMENT_CHECKER_UI_ACCESS_TOKEN }}
+  {{- if .Values.ENVIRONMENT_CHECKER_UI_ACCESS_TOKEN }}
   access-token: {{ .Values.ENVIRONMENT_CHECKER_UI_ACCESS_TOKEN }}
-{{- else }}
+  {{- else }}
   access-token: f9a3bd4e9f2c3be01cd629154cfb224c2703181e050254b5
-{{- end }}
+  {{- end }}

charts/env-checker/templates/_templates.yaml

@@ -12,11 +12,14 @@
       name: env-checker-ui-access-token
       key: access-token
 {{- end }}
+...
+---
 {{- define "envchecker.pod.volumeMounts" }}
 - name: application-config
   mountPath: "/etc/config/application.properties"
 {{- end }}
-
+...
+---
 {{- define "envchecker.pod.resources" }}
 requests:
   cpu: '{{ .Values.CPU_REQUEST | default "100m" }}'
@@ -25,7 +28,8 @@ limits:
   memory: '{{ .Values.MEMORY_LIMIT | default "2Gi" }}'
   cpu: '{{ .Values.CPU_LIMIT | default "1000m" }}'
 {{- end }}
-
+...
+---
 {{- define "envchecker.pod.volumes" }}
 volumes:
   - name: application-config
@@ -34,4 +38,5 @@ volumes:
       items:
         - key: "application.properties"
           path: "application.properties"
-{{- end }}
+{{- end }}
+...