chore(release): 0.5.34 [skip ci]

## [0.5.34](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.33...v0.5.34) (2023-11-09) ### Bug Fixes * **openproject:** Bump helmchart and properly template OP's initdb image ([0d8e92f](0d8e92fc5a))
fix(openproject): Bump helmchart and properly template OP's initdb image
2025-12-06 15:31:38 +01:00 · 2023-11-09 16:23:55 +00:00 · 2023-11-09 16:21:30 +00:00 · 2023-11-09 08:54:47 +00:00 · 2023-11-09 08:52:55 +00:00
6 changed files with 34 additions and 7 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,17 @@
+## [0.5.34](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.33...v0.5.34) (2023-11-09)
+
+
+### Bug Fixes
+
+* **openproject:** Bump helmchart and properly template OP's initdb image ([0d8e92f](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/0d8e92fc5a4729ff7649e5a10e629b962a9b671b))
+
+## [0.5.33](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.32...v0.5.33) (2023-11-09)
+
+
+### Bug Fixes
+
+* **cryptpad:** Update security context ([89ae1d9](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/89ae1d94ea4c4e8a15a395a80847a7f235365747))
+
 ## [0.5.32](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.31...v0.5.32) (2023-11-09)


--- a/README.md
+++ b/README.md
@@ -385,7 +385,7 @@ This list gives you an overview of default security settings and if they comply
 |             | icap                     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
 |             | milter                   | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
 | Collabora   | collabora                |        :x:         |                :x:                 | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`, `MKNOD`) |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    100    |    101     |   100   |
-| CryptPad    | cryptpad                 |        :x:         |                :x:                 |                                                                      :x:                                                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |  4001   |
+| CryptPad    | cryptpad                 |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   4001    |   4001     |  4001   |
 | Element     | element                  | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
 |             | synapse                  | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   10991   |     -      |  10991  |
 |             | synapseWeb               | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
--- a/helmfile/apps/cryptpad/values.yaml
+++ b/helmfile/apps/cryptpad/values.yaml
@@ -29,14 +29,16 @@ podSecurityContext:
  fsGroup: 4001

 securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
  seccompProfile:
    type: "RuntimeDefault"
-  # capabilities:
-  #   drop:
-  #   - ALL
  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  # runAsUser: 1000
+  runAsNonRoot: true
+  runAsUser: 4001
+  runAsGroup: 4001

 serviceAccount:
  create: true
--- a/helmfile/apps/openproject/helmfile.yaml
+++ b/helmfile/apps/openproject/helmfile.yaml
@@ -16,7 +16,7 @@ repositories:
 releases:
  - name: "openproject"
    chart: "openproject-repo/openproject"
-    version: "2.0.4"
+    version: "2.4.0"
    wait: true
    waitForJobs: true
    values:
--- a/helmfile/apps/openproject/values.gotmpl
+++ b/helmfile/apps/openproject/values.gotmpl
@@ -13,6 +13,13 @@ image:
  pullPolicy: "{{ .Values.global.imagePullPolicy }}"
  tag: "{{ .Values.images.openproject.tag }}"

+initdb:
+  image:
+    registry: "{{ .Values.global.imageRegistry }}"
+    repository: "{{ .Values.images.openprojectInitDb.repository }}"
+    tag: "{{ .Values.images.openprojectInitDb.tag }}"
+    pullPolicy: "{{ .Values.global.imagePullPolicy }}"
+
 memcached:
  connection:
    host: "{{ .Values.cache.openproject.host }}"
--- a/helmfile/environments/default/images.yaml
+++ b/helmfile/environments/default/images.yaml
@@ -120,6 +120,10 @@ images:
    repository: "openproject/open_desk"
    tag: "dev@sha256:ca5b843fd7f0687617ce3038a52fd6ac73fb4e9db7b762b8ac7d5090f168f0b1"
    # @supplier: "OpenProject"
+  openprojectInitDb:
+    repository: "postgres"
+    tag: "13@sha256:ced3ba927f4cf06e03eac7760f426a95367076fb31fe4e31b679f82d119a3519"
+    # @supplier: "OpenProject"
  openxchangeBootstrap:
    repository: "alpine/k8s"
    tag: "1.26.8@sha256:acde24d2a8ebaafda76f464591a5ddc7d0acd08bb38b12560961c1b1c4fc85ec"
Author	SHA1	Message	Date
openDesk	ea5bd0a6b7	chore(release): 0.5.34 [skip ci] ## [0.5.34](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.33...v0.5.34) (2023-11-09) ### Bug Fixes * openproject: Bump helmchart and properly template OP's initdb image ([`0d8e92f`](`0d8e92fc5a`))	2023-11-09 16:23:55 +00:00
Thorsten Rossner	0d8e92fc5a	fix(openproject): Bump helmchart and properly template OP's initdb image	2023-11-09 16:21:30 +00:00
openDesk	d7119a656b	chore(release): 0.5.33 [skip ci] ## [0.5.33](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.32...v0.5.33) (2023-11-09) ### Bug Fixes * cryptpad: Update security context ([`89ae1d9`](`89ae1d94ea`))	2023-11-09 08:54:47 +00:00
Thomas Kaltenbrunner	89ae1d94ea	fix(cryptpad): Update security context	2023-11-09 08:52:55 +00:00