Merge pull request #132 from Linkurious/develop

Release 0.0.23 [ci:run]

Author: linkurious-infra

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.0.22
+current_version = 0.0.23
 commit = False
 tag = False
 serialize = 

.version

@@ -1 +1 @@
-0.0.22
+0.0.23

Jenkinsfile

@@ -3,6 +3,8 @@
 dockerJob {
   // General
   projectName = "linkurious/docker-neo4j"
+  podTemplateNames = ['jnlp-agent']
+  buildkitBuilder = true
 
   // helmReleaseBranch = "develop"
 

charts/neo4j-internal/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.13
+version: 0.1.14
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/neo4j-internal/values.preprod.yaml

@@ -1,4 +1,20 @@
+# https://github.com/neo4j/helm-charts/blob/dev/neo4j/values.yaml
+
 neo4j-standalone:
+
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 7474
+    runAsGroup: 7474
+    fsGroup: 7474
+    seccompProfile:
+      type: RuntimeDefault
+
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ['ALL']
+
   neo4j:
     resources:
       requests:
@@ -38,6 +54,10 @@ neo4j-standalone:
   podSpec:
     initContainers:
       - name: git-sync
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ['ALL']
         image: k8s.gcr.io/git-sync/git-sync:v3.5.0
         env:
         - name: GIT_SYNC_REPO
@@ -52,7 +72,11 @@ neo4j-standalone:
           - name: data
             mountPath: /tmp/git/
       - name: neo4j-restore
-          # command: ['ls', '-lah', '/data/git-sync/', '&&', '/data/git-sync/docker-neo4j/scripts/dataset-download.sh']
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ['ALL']
+        # command: ['ls', '-lah', '/data/git-sync/', '&&', '/data/git-sync/docker-neo4j/scripts/dataset-download.sh']
         command: ['/data/docker-neo4j/scripts/dataset-download.sh', '-p', '/data']
         envFrom:
           - secretRef:

charts/neo4j-internal/values.yaml

@@ -64,6 +64,10 @@ neo4j-standalone:
   podSpec:
     initContainers:
       - name: git-sync
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ['ALL']
         image: registry.k8s.io/git-sync/git-sync:v3.6.9
         env:
         - name: GIT_SYNC_REPO
@@ -78,6 +82,10 @@ neo4j-standalone:
           - name: data
             mountPath: /tmp/git/
       - name: neo4j-restore
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ['ALL']
         image: neo4j:4.4.25-enterprise
           # command: ['ls', '-lah', '/data/git-sync/', '&&', '/data/git-sync/docker-neo4j/scripts/dataset-download.sh']
         command: ['/data/docker-neo4j/scripts/dataset-download.sh', '-p', '/data']

charts/neo4jv5-internal/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.0.23
+version: 0.0.24
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/neo4jv5-internal/values.preprod.yaml

@@ -1,4 +1,20 @@
+# https://github.com/neo4j/helm-charts/blob/dev/neo4j/values.yaml
+
 neo4j:
+
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 7474
+    runAsGroup: 7474
+    fsGroup: 7474
+    seccompProfile:
+      type: RuntimeDefault
+
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ['ALL']
+
   disableLookups: true
   neo4j:
     name: neo4jv5-internal
@@ -39,6 +55,10 @@ neo4j:
   podSpec:
     initContainers:
       - name: git-sync
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ['ALL']
         image: k8s.gcr.io/git-sync/git-sync:v3.6.2
         env:
         - name: GIT_SYNC_REPO
@@ -53,7 +73,11 @@ neo4j:
           - name: data
             mountPath: /tmp/git/
       - name: neo4j-restore
-          # command: ['ls', '-lah', '/data/git-sync/', '&&', '/data/git-sync/docker-neo4j/scripts/dataset-download.sh']
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ['ALL']
+        # command: ['ls', '-lah', '/data/git-sync/', '&&', '/data/git-sync/docker-neo4j/scripts/dataset-download.sh']
         command: ['/data/docker-neo4j/scripts/dataset-download.sh', '-p', '/data']
         envFrom:
           - secretRef:

charts/neo4jv5-internal/values.prod.yaml

@@ -1,4 +1,20 @@
+# https://github.com/neo4j/helm-charts/blob/dev/neo4j/values.yaml
+
 neo4j:
+
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 7474
+    runAsGroup: 7474
+    fsGroup: 7474
+    seccompProfile:
+      type: RuntimeDefault
+
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ['ALL']
+
   disableLookups: true
   neo4j:
     name: neo4jv5-internal
@@ -79,6 +95,10 @@ neo4j:
   podSpec:
     initContainers:
       - name: git-sync
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ['ALL']
         image: k8s.gcr.io/git-sync/git-sync:v3.6.2
         env:
         - name: GIT_SYNC_REPO
@@ -93,7 +113,11 @@ neo4j:
           - name: data
             mountPath: /tmp/git/
       - name: neo4j-restore
-          # command: ['ls', '-lah', '/data/git-sync/', '&&', '/data/git-sync/docker-neo4j/scripts/dataset-download.sh']
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ['ALL']
+        # command: ['ls', '-lah', '/data/git-sync/', '&&', '/data/git-sync/docker-neo4j/scripts/dataset-download.sh']
         command: ['/data/docker-neo4j/scripts/dataset-download.sh', '-p', '/data']
         envFrom:
           - secretRef:

charts/neo4jv5-internal/values.saas-trials.yaml

@@ -1,4 +1,20 @@
+# https://github.com/neo4j/helm-charts/blob/dev/neo4j/values.yaml
+
 neo4j:
+
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 7474
+    runAsGroup: 7474
+    fsGroup: 7474
+    seccompProfile:
+      type: RuntimeDefault
+
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ['ALL']
+
   disableLookups: true
   neo4j:
     name: neo4jv5-internal
@@ -51,6 +67,10 @@ neo4j:
   podSpec:
     initContainers:
       - name: git-sync
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ['ALL']
         image: k8s.gcr.io/git-sync/git-sync:v3.6.2
         env:
         - name: GIT_SYNC_REPO
@@ -65,7 +85,11 @@ neo4j:
           - name: data
             mountPath: /tmp/git/
       - name: neo4j-restore
-          # command: ['ls', '-lah', '/data/git-sync/', '&&', '/data/git-sync/docker-neo4j/scripts/dataset-download.sh']
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ['ALL']
+        # command: ['ls', '-lah', '/data/git-sync/', '&&', '/data/git-sync/docker-neo4j/scripts/dataset-download.sh']
         command: ['/data/docker-neo4j/scripts/dataset-download.sh', '-p', '/data']
         envFrom:
           - secretRef: