Merge pull request #887 from banzaicloud/openshift_support

Openshift support 4.11+ [release-1.16]

Author: nishantapatil3

Dockerfile

@@ -1,5 +1,14 @@
+ARG GID=1000
+ARG UID=1000
+
 # Build the manager binary
 FROM golang:1.18 as builder
+ARG GID
+ARG UID
+
+# Create user and group
+RUN groupadd -g ${GID} appgroup && \
+    useradd -u ${UID} --gid appgroup appuser
 
 WORKDIR /workspace
 # Copy the Go Modules manifests
@@ -29,8 +38,14 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 make build
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
 FROM gcr.io/distroless/static:nonroot
+ARG GID
+ARG UID
+
 WORKDIR /
 COPY --from=builder /workspace/bin/manager /manager
-USER nonroot:nonroot
+
+COPY --from=builder /etc/passwd /etc/passwd
+COPY --from=builder /etc/group /etc/group
+USER ${UID}:${GID}
 
 ENTRYPOINT ["/manager"]

Makefile

@@ -17,7 +17,7 @@ EMBEDDED_CHART_REL_TAG ?= deploy/charts/v${CHART_VERSION}
 HELM_CHART_REL_TAG ?= chart/istio-operator/${CHART_VERSION}
 
 GOLANGCI_VERSION = 1.45.2
-LICENSEI_VERSION = 0.4.0
+LICENSEI_VERSION = 0.7.0
 ENVTEST_K8S_VERSION = 1.24.2
 KUSTOMIZE_VERSION = 4.1.2
 ISTIO_VERSION = 1.16.1

deploy/charts/istio-operator/Chart.yaml

@@ -11,5 +11,5 @@ icon: https://istio.io/latest/img/istio-whitelogo-bluebackground-framed.svg
 # Based on support status of Istio releases: https://istio.io/latest/docs/releases/supported-releases/#support-status-of-istio-releases
 kubeVersion: ">= 1.22.0-0 < 1.26.0-0"
 
-version: 2.1.0
-appVersion: "v2.16.0"
+version: 2.1.1
+appVersion: "v2.16.1"

deploy/charts/istio-operator/README.md

@@ -33,7 +33,7 @@ The following table lists the configurable parameters of the Banzaicloud Istio O
 | Parameter                                      | Description                                                                                                                                                                                         | Default                                                                                  |
 |------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------|
 | `image.repository`                             | Operator container image repository                                                                                                                                                                 | `ghcr.io/banzaicloud/istio-operator`                                                     |
-| `image.tag`                                    | Operator container image tag                                                                                                                                                                        | `v2.16.0`                                                                           |
+| `image.tag`                                    | Operator container image tag                                                                                                                                                                        | `v2.16.1`                                                                                |
 | `image.pullPolicy`                             | Operator container image pull policy                                                                                                                                                                | `IfNotPresent`                                                                           |
 | `replicaCount`                                 | Operator deployment replica count                                                                                                                                                                   | `1`                                                                                      |
 | `extraArgs`                                    | Operator deployment arguments                                                                                                                                                                       | `[]`                                                                                     |

deploy/charts/istio-operator/templates/operator-deployment.yaml

@@ -43,6 +43,8 @@ spec:
         ports:
           - containerPort: 8443
             name: https
+        securityContext:
+          {{- toYaml .Values.securityContext | nindent 10 }}
       {{- end }}
       - command:
         - /manager

deploy/charts/istio-operator/values.yaml

@@ -1,6 +1,6 @@
 image:
   repository: ghcr.io/banzaicloud/istio-operator
-  tag: "v2.16.0"
+  tag: "v2.16.1"
   pullPolicy: IfNotPresent
 replicaCount: 1
 extraArgs: []
@@ -11,11 +11,11 @@ resources:
 podAnnotations:
   sidecar.istio.io/inject: "false"
 podSecurityContext:
-  fsGroup: 1337
-securityContext:
-  runAsUser: 1337
-  runAsGroup: 1337
   runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault
+securityContext:
+  allowPrivilegeEscalation: false
   capabilities:
     drop:
       - ALL