177 collab intel rofs on open shift avoid run as user 0 support fs group

charts/collab/Chart.yaml

@@ -3,7 +3,7 @@ name: codetogether-collab
 description: CodeTogether Collab
 
 type: application
-version: 1.2.4
+version: 1.2.5
 appVersion: "2025.1.0"
 
 icon: https://www.codetogether.com/wp-content/uploads/2020/02/codetogether-circle-128.png

charts/collab/templates/deployment.yaml

@@ -194,10 +194,6 @@ spec:
               name: codetogether-runtime
             - mountPath: /tmp
               name: codetogether-tmp
-            - mountPath: /var/log/nginx
-              name: codetogether-runtime
-            - mountPath: /var/cache/nginx
-              name: codetogether-runtime
             {{- if .Values.favicon.enabled }}
             - mountPath: /opt/volatile-template/nginx/favicon.ico
               name: favicon-volume
@@ -248,13 +244,13 @@ spec:
 
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+
       {{- if .Values.securityContext.readOnlyRootFilesystem}}
       volumes:
         - name: codetogether-runtime
           emptyDir: {}
         - name: codetogether-tmp
-          emptyDir:
-            medium: Memory
+          emptyDir: {}
       {{- else if .Values.favicon.enabled }}
       volumes:
         - name: favicon-volume

charts/collab/values.yaml

@@ -217,7 +217,8 @@ securityContext: {} #defaults
   #   - ALL
   # readOnlyRootFilesystem: true # enable for read-only setup
   # runAsNonRoot: true
-  # runAsUser: 0 # Use '0' for root user for read-only setup
+  # runAsUser: 1000 # Use '0' for root user, in vanilla k8s you can use any non-root uid
+  # In openshift, dont set runAsUser, let OpenShift assign the values
 
 readinessProbe:
   initialDelaySeconds: 60

charts/intel/Chart.yaml

@@ -3,7 +3,7 @@ name: codetogether-intel
 description: CodeTogether Intel provides advanced project insights for developers
 
 type: application
-version: 1.2.7
+version: 1.2.8
 appVersion: "2025.3.0"
 
 icon: https://www.codetogether.com/wp-content/uploads/2020/02/codetogether-circle-128.png

charts/intel/templates/deployment.yaml

@@ -99,7 +99,6 @@ spec:
                   key: apiKey
               {{- end }}
             {{- end }}
-{{- if .Values.securityContext.readOnlyRootFilesystem }}
           volumeMounts:
             - name: properties-volume
               mountPath: /opt/codetogether/runtime/cthq.properties
@@ -109,26 +108,6 @@ spec:
               mountPath: /etc/ssl/certs/java/cacerts
               subPath: cacerts
             {{- end }}
-            # Read-only root FS mounts
-            - mountPath: /run
-              name: codetogether-runtime
-            - mountPath: /tmp
-              name: codetogether-tmp
-            - mountPath: /var/log/nginx
-              name: codetogether-runtime
-            - mountPath: /var/cache/nginx
-              name: codetogether-runtime
-{{- else }}
-          volumeMounts:
-            - name: properties-volume
-              mountPath: /opt/codetogether/runtime/cthq.properties
-              subPath: cthq.properties
-            {{- if .Values.java.customCacerts.enabled }}
-            - name: java-cacerts
-              mountPath: /etc/ssl/certs/java/cacerts
-              subPath: cacerts
-            {{- end }}
-{{- end }}
           ports:
             - name: http
               containerPort: 1080
@@ -177,14 +156,6 @@ spec:
           secret:
             secretName: {{ .Values.java.customCacerts.cacertsSecretName }}
         {{- end }}
-{{- if .Values.securityContext.readOnlyRootFilesystem }}
-        - name: codetogether-runtime
-          emptyDir: {}
-        - name: codetogether-tmp
-          emptyDir:
-            medium: Memory
-{{- end }}
-
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/intel/values.yaml

@@ -132,14 +132,14 @@ serviceAccount:
 
 podAnnotations: {}
 
-securityContext: {} #defaults to
-
+securityContext: {} #defaults
   # capabilities:
   #   drop:
   #   - ALL
-  #readOnlyRootFilesystem: true  # enable for read-only setup
-  # runAsNonRoot: true           # false for non-root user
-  # runAsUser: 0 # Use '0' for root user for read-only setup
+  # readOnlyRootFilesystem: true # enable for read-only setup
+  # runAsNonRoot: true
+  # runAsUser: 1000 # Use '0' for root user
+  # In openshift, dont set runAsUser, let OpenShift assign the values
 
 ai:
   enabled: false