Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: add repro for tj-actions/changed-files #6644

Closed
wants to merge 1 commit into from
Closed

chore: add repro for tj-actions/changed-files #6644

wants to merge 1 commit into from

Conversation

onedr0p
Copy link
Owner

@onedr0p onedr0p commented Dec 24, 2023

No description provided.

@bot-ross bot-ross bot added area/github Changes made in the github directory area/kubernetes Changes made in the kubernetes directory cluster/main labels Dec 24, 2023
@onedr0p onedr0p mentioned this pull request Dec 24, 2023
Closed
2 tasks
@onedr0p onedr0p closed this Dec 24, 2023
@onedr0p onedr0p reopened this Dec 24, 2023
@bot-ross
Copy link
Contributor

bot-ross bot commented Dec 24, 2023 

--- kubernetes/main/apps/network/nginx/external Kustomization: flux-system/nginx-external HelmRelease: network/nginx-external

+++ kubernetes/main/apps/network/nginx/external Kustomization: flux-system/nginx-external HelmRelease: network/nginx-external

@@ -13,13 +13,13 @@

     spec:
       chart: ingress-nginx
       sourceRef:
         kind: HelmRepository
         name: ingress-nginx
         namespace: flux-system
-      version: 4.9.0
+      version: 4.8.3
   install:
     remediation:
       retries: 3
   interval: 30m
   uninstall:
     keepHistory: false
--- kubernetes/main/apps/network/nginx/internal Kustomization: flux-system/nginx-internal HelmRelease: network/nginx-internal

+++ kubernetes/main/apps/network/nginx/internal Kustomization: flux-system/nginx-internal HelmRelease: network/nginx-internal

@@ -13,13 +13,13 @@

     spec:
       chart: ingress-nginx
       sourceRef:
         kind: HelmRepository
         name: ingress-nginx
         namespace: flux-system
-      version: 4.9.0
+      version: 4.8.3
   install:
     remediation:
       retries: 3
   interval: 30m
   uninstall:
     keepHistory: false

@bot-ross
Copy link
Contributor

bot-ross bot commented Dec 24, 2023 

--- HelmRelease: network/nginx-internal Deployment: network/nginx-internal-controller

+++ HelmRelease: network/nginx-internal Deployment: network/nginx-internal-controller

@@ -28,13 +28,13 @@

         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: controller
     spec:
       dnsPolicy: ClusterFirst
       containers:
       - name: controller
-        image: registry.k8s.io/ingress-nginx/controller:v1.9.5@sha256:b3aba22b1da80e7acfc52b115cae1d4c687172cbf2b742d5b502419c25ff340e
+        image: registry.k8s.io/ingress-nginx/controller:v1.9.4@sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
             exec:
               command:
               - /wait-shutdown
@@ -47,23 +47,19 @@

         - --configmap=$(POD_NAMESPACE)/nginx-internal-controller
         - --validating-webhook=:8443
         - --validating-webhook-certificate=/usr/local/certificates/cert
         - --validating-webhook-key=/usr/local/certificates/key
         - --default-ssl-certificate=network/devbu-io-tls
         securityContext:
-          runAsNonRoot: true
-          runAsUser: 101
-          allowPrivilegeEscalation: false
-          seccompProfile:
-            type: RuntimeDefault
           capabilities:
             drop:
             - ALL
             add:
             - NET_BIND_SERVICE
-          readOnlyRootFilesystem: false
+          runAsUser: 101
+          allowPrivilegeEscalation: true
         env:
         - name: POD_NAME
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
         - name: POD_NAMESPACE
--- HelmRelease: network/nginx-internal ValidatingWebhookConfiguration: network/nginx-internal-admission

+++ HelmRelease: network/nginx-internal ValidatingWebhookConfiguration: network/nginx-internal-admission

@@ -25,14 +25,14 @@

   failurePolicy: Fail
   sideEffects: None
   admissionReviewVersions:
   - v1
   clientConfig:
     service:
+      namespace: network
       name: nginx-internal-controller-admission
-      namespace: network
       path: /networking/v1/ingresses
   objectSelector:
     matchExpressions:
     - key: ingress-class
       operator: In
       values:
--- HelmRelease: network/nginx-internal Job: network/nginx-internal-admission-create

+++ HelmRelease: network/nginx-internal Job: network/nginx-internal-admission-create

@@ -37,19 +37,15 @@

         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         securityContext:
           allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 65532
-          seccompProfile:
-            type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: nginx-internal-admission
       nodeSelector:
         kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 2000
+        runAsNonRoot: true
+        runAsUser: 2000
 
--- HelmRelease: network/nginx-internal Job: network/nginx-internal-admission-patch

+++ HelmRelease: network/nginx-internal Job: network/nginx-internal-admission-patch

@@ -39,19 +39,15 @@

         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         securityContext:
           allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 65532
-          seccompProfile:
-            type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: nginx-internal-admission
       nodeSelector:
         kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 2000
+        runAsNonRoot: true
+        runAsUser: 2000
 
--- HelmRelease: network/nginx-internal NetworkPolicy: network/nginx-internal-admission

+++ HelmRelease: network/nginx-internal NetworkPolicy: network/nginx-internal-admission

@@ -0,0 +1,27 @@

+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: nginx-internal-admission
+  namespace: network
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+  labels:
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/instance: nginx-internal
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: admission-webhook
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: ingress-nginx
+      app.kubernetes.io/instance: nginx-internal
+      app.kubernetes.io/component: admission-webhook
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - {}
+
--- HelmRelease: network/nginx-external Deployment: network/nginx-external-controller

+++ HelmRelease: network/nginx-external Deployment: network/nginx-external-controller

@@ -28,13 +28,13 @@

         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: controller
     spec:
       dnsPolicy: ClusterFirst
       containers:
       - name: controller
-        image: registry.k8s.io/ingress-nginx/controller:v1.9.5@sha256:b3aba22b1da80e7acfc52b115cae1d4c687172cbf2b742d5b502419c25ff340e
+        image: registry.k8s.io/ingress-nginx/controller:v1.9.4@sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
             exec:
               command:
               - /wait-shutdown
@@ -47,23 +47,19 @@

         - --configmap=$(POD_NAMESPACE)/nginx-external-controller
         - --validating-webhook=:8443
         - --validating-webhook-certificate=/usr/local/certificates/cert
         - --validating-webhook-key=/usr/local/certificates/key
         - --default-ssl-certificate=network/devbu-io-tls
         securityContext:
-          runAsNonRoot: true
-          runAsUser: 101
-          allowPrivilegeEscalation: false
-          seccompProfile:
-            type: RuntimeDefault
           capabilities:
             drop:
             - ALL
             add:
             - NET_BIND_SERVICE
-          readOnlyRootFilesystem: false
+          runAsUser: 101
+          allowPrivilegeEscalation: true
         env:
         - name: POD_NAME
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
         - name: POD_NAMESPACE
--- HelmRelease: network/nginx-external ValidatingWebhookConfiguration: network/nginx-external-admission

+++ HelmRelease: network/nginx-external ValidatingWebhookConfiguration: network/nginx-external-admission

@@ -25,14 +25,14 @@

   failurePolicy: Fail
   sideEffects: None
   admissionReviewVersions:
   - v1
   clientConfig:
     service:
+      namespace: network
       name: nginx-external-controller-admission
-      namespace: network
       path: /networking/v1/ingresses
   objectSelector:
     matchExpressions:
     - key: ingress-class
       operator: In
       values:
--- HelmRelease: network/nginx-external Job: network/nginx-external-admission-create

+++ HelmRelease: network/nginx-external Job: network/nginx-external-admission-create

@@ -37,19 +37,15 @@

         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         securityContext:
           allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 65532
-          seccompProfile:
-            type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: nginx-external-admission
       nodeSelector:
         kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 2000
+        runAsNonRoot: true
+        runAsUser: 2000
 
--- HelmRelease: network/nginx-external Job: network/nginx-external-admission-patch

+++ HelmRelease: network/nginx-external Job: network/nginx-external-admission-patch

@@ -39,19 +39,15 @@

         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         securityContext:
           allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 65532
-          seccompProfile:
-            type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: nginx-external-admission
       nodeSelector:
         kubernetes.io/os: linux
+      securityContext:
+        fsGroup: 2000
+        runAsNonRoot: true
+        runAsUser: 2000
 
--- HelmRelease: network/nginx-external NetworkPolicy: network/nginx-external-admission

+++ HelmRelease: network/nginx-external NetworkPolicy: network/nginx-external-admission

@@ -0,0 +1,27 @@

+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: nginx-external-admission
+  namespace: network
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+  labels:
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/instance: nginx-external
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: admission-webhook
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: ingress-nginx
+      app.kubernetes.io/instance: nginx-external
+      app.kubernetes.io/component: admission-webhook
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - {}
+

@onedr0p onedr0p closed this Dec 24, 2023
@onedr0p onedr0p deleted the test-changed-action branch December 24, 2023 18:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
area/github Changes made in the github directory area/kubernetes Changes made in the kubernetes directory
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@onedr0p