Skip to content

Commit b4c10ea

Browse files
pooja-intelvkb1
pooja-intel
authored and
vkb1
committed
industrial-edge-insights-timeseries: Trivy file scan fix (#1867)
Changes: - Updated cryptography package from 44.0.1 to 46.0.5 to address security vulnerabilities - Updated influxdb image from 1.11.8 to 1.12.2 across docker-compose and Helm deployments - Added comprehensive pod-level and container-level security contexts (runAsNonRoot, seccompProfile) to 11 Helm templates for compliance with security best practices Signed-off-by: Pooja Kumbharkar <pooja.kumbharkar@intel.com>
1 parent 063dc25 commit b4c10ea

File tree

19 files changed

+91
-5
lines changed

19 files changed

+91
-5
lines changed

‎manufacturing-ai-suite/industrial-edge-insights-multimodal/docker-compose.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ services:
4444

4545
ia-influxdb:
4646
user: "${TIMESERIES_UID}:${TIMESERIES_UID}"
47-
image: influxdb:1.11.8
47+
image: influxdb:1.12.2
4848
container_name: ia-influxdb
4949
hostname: ia-influxdb
5050
restart: unless-stopped

‎manufacturing-ai-suite/industrial-edge-insights-multimodal/helm/templates/broker.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,21 @@ spec:
3737
labels:
3838
app: ia-mqtt-broker
3939
spec:
40+
securityContext:
41+
runAsNonRoot: true
42+
runAsUser: {{ $.Values.env.TIMESERIES_UID }}
43+
runAsGroup: {{ $.Values.env.TIMESERIES_UID }}
44+
fsGroup: {{ $.Values.env.TIMESERIES_UID }}
45+
seccompProfile:
46+
type: RuntimeDefault
4047
containers:
4148
- name: ia-mqtt-broker
4249
image: eclipse-mosquitto:2.0.22
4350
imagePullPolicy: {{ .Values.imagePullPolicy }}
4451
securityContext:
4552
runAsUser: {{ $.Values.env.TIMESERIES_UID }}
4653
runAsGroup: {{ $.Values.env.TIMESERIES_UID }}
54+
runAsNonRoot: true
4755
readOnlyRootFilesystem: true
4856
allowPrivilegeEscalation: false
4957
capabilities:

‎manufacturing-ai-suite/industrial-edge-insights-multimodal/helm/templates/coturn.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@ spec:
4949
securityContext:
5050
runAsNonRoot: true
5151
runAsUser: 1000
52+
seccompProfile:
53+
type: RuntimeDefault
5254
containers:
5355
- name: coturn
5456
image: coturn/coturn:4.8.0

‎manufacturing-ai-suite/industrial-edge-insights-multimodal/helm/templates/dlstreamer-pipeline-server.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,10 @@ spec:
3939
app: dlstreamer-pipeline-server
4040
spec:
4141
securityContext:
42+
runAsNonRoot: true
43+
runAsUser: 1999
44+
seccompProfile:
45+
type: RuntimeDefault
4246
supplementalGroups: [109,110,992] # render group IDs for ubuntu 20.04, 22.04 and 24.04 host OS
4347
{{- if and $.Values.DOCKER_USERNAME $.Values.DOCKER_PASSWORD }}
4448
imagePullSecrets:

‎manufacturing-ai-suite/industrial-edge-insights-multimodal/helm/templates/fusion-analytics.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,13 @@ spec:
2525
imagePullSecrets:
2626
- name: registryauth
2727
{{- end }}
28+
securityContext:
29+
runAsNonRoot: true
30+
runAsUser: {{ $.Values.env.TIMESERIES_UID }}
31+
runAsGroup: {{ $.Values.env.TIMESERIES_UID }}
32+
fsGroup: {{ $.Values.env.TIMESERIES_UID }}
33+
seccompProfile:
34+
type: RuntimeDefault
2835
containers:
2936
- name: fusion-analytics
3037
image: {{ .Values.DOCKER_REGISTRY }}{{ .Values.images.fusion_analytics_image }}:{{ .Values.images.image_suffix | default "latest" }}{{ if .Values.images.weekly_build_date }}-{{ .Values.images.weekly_build_date }}-weekly{{ end }}
@@ -34,6 +41,7 @@ spec:
3441
runAsGroup: {{ .Values.env.TIMESERIES_UID }}
3542
allowPrivilegeEscalation: false
3643
readOnlyRootFilesystem: true
44+
runAsNonRoot: true
3745
capabilities:
3846
drop:
3947
- ALL

‎manufacturing-ai-suite/industrial-edge-insights-multimodal/helm/templates/grafana.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,13 @@ spec:
3535
labels:
3636
app: ia-grafana
3737
spec:
38+
securityContext:
39+
runAsNonRoot: true
40+
runAsUser: {{ $.Values.env.TIMESERIES_UID }}
41+
runAsGroup: {{ $.Values.env.TIMESERIES_UID }}
42+
fsGroup: {{ $.Values.env.TIMESERIES_UID }}
43+
seccompProfile:
44+
type: RuntimeDefault
3845
{{- if and $.Values.DOCKER_USERNAME $.Values.DOCKER_PASSWORD }}
3946
imagePullSecrets:
4047
- name: registryauth
@@ -44,6 +51,9 @@ spec:
4451
image: grafana/grafana-oss:12.3.3-ubuntu
4552
imagePullPolicy: {{ $.Values.imagePullPolicy }}
4653
securityContext:
54+
runAsUser: {{ $.Values.env.TIMESERIES_UID }}
55+
runAsGroup: {{ $.Values.env.TIMESERIES_UID }}
56+
runAsNonRoot: true
4757
readOnlyRootFilesystem: true
4858
allowPrivilegeEscalation: false
4959
capabilities:

‎manufacturing-ai-suite/industrial-edge-insights-multimodal/helm/templates/influxdb.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,17 +33,25 @@ spec:
3333
labels:
3434
app: influxdb
3535
spec:
36+
securityContext:
37+
runAsNonRoot: true
38+
runAsUser: {{ $.Values.env.TIMESERIES_UID }}
39+
runAsGroup: {{ $.Values.env.TIMESERIES_UID }}
40+
fsGroup: {{ $.Values.env.TIMESERIES_UID }}
41+
seccompProfile:
42+
type: RuntimeDefault
3643
{{- if and .Values.DOCKER_USERNAME .Values.DOCKER_PASSWORD }}
3744
imagePullSecrets:
3845
- name: registryauth
3946
{{- end }}
4047
containers:
4148
- name: ia-influxdb
42-
image: influxdb:1.11.8
49+
image: influxdb:1.12.2
4350
imagePullPolicy: {{ .Values.imagePullPolicy }}
4451
securityContext:
4552
runAsUser: {{ $.Values.env.TIMESERIES_UID }}
4653
runAsGroup: {{ $.Values.env.TIMESERIES_UID }}
54+
runAsNonRoot: true
4755
readOnlyRootFilesystem: true
4856
allowPrivilegeEscalation: false
4957
capabilities:

‎manufacturing-ai-suite/industrial-edge-insights-multimodal/helm/templates/mediamtx.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@ spec:
5757
securityContext:
5858
runAsNonRoot: true
5959
runAsUser: 1000
60+
seccompProfile:
61+
type: RuntimeDefault
6062
containers:
6163
- name: mediamtx
6264
env:

‎manufacturing-ai-suite/industrial-edge-insights-multimodal/helm/templates/nginx.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,12 @@ spec:
4040
labels:
4141
app: nginx
4242
spec:
43+
securityContext:
44+
runAsUser: {{ $.Values.env.TIMESERIES_UID }}
45+
runAsGroup: {{ $.Values.env.TIMESERIES_UID }}
46+
runAsNonRoot: true
47+
seccompProfile:
48+
type: RuntimeDefault
4349
containers:
4450
- name: nginx-proxy
4551
image: nginx:1.29.1-bookworm-perl
@@ -49,6 +55,7 @@ spec:
4955
runAsGroup: {{ $.Values.env.TIMESERIES_UID }}
5056
allowPrivilegeEscalation: false
5157
readOnlyRootFilesystem: true
58+
runAsNonRoot: true
5259
capabilities:
5360
drop:
5461
- ALL

‎manufacturing-ai-suite/industrial-edge-insights-multimodal/helm/templates/seaweedfs-filer.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,9 @@ spec:
4040
fsGroup: {{ .Values.env.TIMESERIES_UID | int }}
4141
runAsUser: {{ .Values.env.TIMESERIES_UID | int }}
4242
runAsGroup: {{ .Values.env.TIMESERIES_UID | int }}
43+
runAsNonRoot: true
44+
seccompProfile:
45+
type: RuntimeDefault
4346
containers:
4447
- name: seaweedfs-filer
4548
image: {{ .Values.images.seaweedfs_image }}

0 commit comments

Comments
 (0)