Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[bitnami/common] feat: ✨ Show warning when original images are replaced #25952

Merged
merged 3 commits into from
May 20, 2024

Conversation

javsalgar
Copy link
Contributor

@javsalgar javsalgar commented May 16, 2024

Signed-off-by: Javier Salmeron Garcia jsalmeron@vmware.com

Description of the change

This PR adds a common warning function to be used in NOTES.txt: common.warnings.modifiedImages. This one checks if the Bitnami shipped images are being replaced by images different from the ones set in Chart.Annotations (the ones that have been verified and tested). We want to warn users of the potential risks of this action.

Example of usage in the matomo chart:

{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.metrics.image .Values.volumePermissions.image .Values.certificates.image) "context" $) }}

If we change one of the images, we see the following warning:

⚠ SECURITY WARNING: Original containers have been substituted. This Helm chart was designed, tested, and validated on multiple platforms using a specific set of Bitnami and Tanzu Application Catalog containers. Substituting other containers is likely to cause degraded security and performance, broken chart features, and missing environment variables.

Substituted images detected:
  - docker.io/fakebitmame:5.0.3-debian-12-r8

Benefits

Users are more aware of the risks of changing the original images

Possible drawbacks

Potential false negatives/positives. This can be further improved in the future.

Checklist

  • Chart version bumped in Chart.yaml according to semver. This is not necessary when the changes only affect README.md files.
  • Variables are documented in the values.yaml and added to the README.md using readme-generator-for-helm
  • Title of the pull request follows this pattern [bitnami/<name_of_the_chart>] Descriptive title
  • All commits signed off and in agreement of Developer Certificate of Origin (DCO)

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
@bitnami-bot bitnami-bot added the verify Execute verification workflow for these changes label May 16, 2024
@github-actions github-actions bot requested a review from rafariossaa May 16, 2024 14:40
Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
rafariossaa
rafariossaa previously approved these changes May 20, 2024
Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
@javsalgar javsalgar merged commit 855045a into main May 20, 2024
10 checks passed
@javsalgar javsalgar deleted the feature/common-detect-non-bitnami branch May 20, 2024 15:24
This was referenced May 21, 2024
fmulero pushed a commit to fmulero/charts that referenced this pull request May 22, 2024
…ed (bitnami#25952)

* [bitnami/common] feat: ✨ Show warning when original images are replaced

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

* feat: ✨ Use annotations

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

* docs: 📝 Add security warning sign

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

---------

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
Signed-off-by: Fran Mulero <fmulero@vmware.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bitnami common solved verify Execute verification workflow for these changes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants