Make initContainer root filesystem read-only (#95)

redhat-developer · Feb 10, 2025 · 9c42717 · 9c42717
1 parent c7c6689
commit 9c42717
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 2 deletions.
diff --git a/charts/backstage/Chart.yaml b/charts/backstage/Chart.yaml
@@ -44,4 +44,4 @@ sources:
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.0.1
+version: 3.0.2
diff --git a/charts/backstage/README.md b/charts/backstage/README.md
@@ -2,7 +2,7 @@
 # RHDH Backstage Helm Chart for OpenShift (Community Version)
 
 [![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/rhdh-chart&style=flat-square)](https://artifacthub.io/packages/search?repo=rhdh-chart)
-![Version: 3.0.1](https://img.shields.io/badge/Version-3.0.1-informational?style=flat-square)
+![Version: 3.0.2](https://img.shields.io/badge/Version-3.0.2-informational?style=flat-square)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 A Helm chart for deploying Red Hat Developer Hub.

diff --git a/charts/backstage/values.schema.json b/charts/backstage/values.schema.json
@@ -4372,6 +4372,7 @@
                                                 "ALL"
                                             ]
                                         },
+                                        "readOnlyRootFilesystem": true,
                                         "runAsNonRoot": true,
                                         "seccompProfile": {
                                             "type": "RuntimeDefault"

diff --git a/charts/backstage/values.yaml b/charts/backstage/values.yaml
@@ -190,6 +190,7 @@ upstream:
             memory: 2.5Gi
             ephemeral-storage: 5Gi
         securityContext:
+          readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
           capabilities:
             drop: ["ALL"]