From b8f835eb3aa516f9f4e3b4720a28b600d957a0a3 Mon Sep 17 00:00:00 2001
From: ston1th <ston1th@giftfish.de>
Date: Sat, 1 Feb 2020 18:01:21 +0100
Subject: [PATCH] fixed nonroot

---
 Dockerfile             | 4 ++--
 config/200-psp.yaml    | 2 +-
 config/deployment.yaml | 8 +++++++-
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 51f73da..cfd5b69 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 FROM golang:alpine as builder
-RUN adduser -D -g '' appuser
+RUN adduser -D -g 65532 -u 65532 appuser
 RUN mkdir /build 
 ADD . /build/
 WORKDIR /build 
@@ -10,5 +10,5 @@ COPY --from=builder /etc/passwd /etc/passwd
 COPY --from=builder /etc/ssl/cert.pem /etc/ssl/cert.pem
 COPY --from=builder /build/main /main
 USER appuser
-EXPOSE 8080
+EXPOSE 8443
 ENTRYPOINT ["/main"]
diff --git a/config/200-psp.yaml b/config/200-psp.yaml
index 9ccbce6..729c7e6 100644
--- a/config/200-psp.yaml
+++ b/config/200-psp.yaml
@@ -13,7 +13,7 @@ spec:
   allowPrivilegeEscalation: false
   requiredDropCapabilities: ["ALL"]
   readOnlyRootFilesystem: true
-  volumes: ["secret"]
+  volumes: ["configMap", "secret"]
   hostNetwork: false
   hostIPC: false
   hostPID: false
diff --git a/config/deployment.yaml b/config/deployment.yaml
index 1d4eb22..4575d64 100644
--- a/config/deployment.yaml
+++ b/config/deployment.yaml
@@ -21,11 +21,17 @@ spec:
       - name: template-solver
         image: git.giftfish.de/ston1th/template-solver
         imagePullPolicy: Always
+        securityContext:
+          runAsUser: 65532
+          runAsGroup: 65532
+          capabilities:
+            drop: ["ALL"]
         resources:
           requests:
             cpu: 100m
             memory: 128Mi
         args:
+        - --secure-port=8443
         - --tls-cert-file=/tls/tls.crt
         - --tls-private-key-file=/tls/tls.key
         env:
@@ -33,7 +39,7 @@ spec:
           value: template-solver
         ports:
         - name: https
-          containerPort: 443
+          containerPort: 8443
           protocol: TCP
         livenessProbe:
           httpGet: