From 1fd271de0f70356a437b5175b178bc6ada8061fb Mon Sep 17 00:00:00 2001 From: 98jan Date: Thu, 12 Mar 2026 19:24:48 +0100 Subject: [PATCH 1/3] fix: update securityContext configuration to allow running in restricted environments --- charts/chatwoot/templates/migrations-job.yaml | 13 +++++++++++-- .../chatwoot/templates/tests/test-connection.yaml | 6 ++++++ charts/chatwoot/templates/web-deployment.yaml | 7 +++++-- charts/chatwoot/templates/worker-deployment.yaml | 7 +++++-- 4 files changed, 27 insertions(+), 6 deletions(-) diff --git a/charts/chatwoot/templates/migrations-job.yaml b/charts/chatwoot/templates/migrations-job.yaml index 0c445e0..7b07e7f 100644 --- a/charts/chatwoot/templates/migrations-job.yaml +++ b/charts/chatwoot/templates/migrations-job.yaml @@ -42,10 +42,16 @@ spec: sleep 2; done; echo "Database ready to accept connections." ; + {{- if .Values.securityContext }} + securityContext: {{ .Values.securityContext | toYaml | nindent 8 }} + {{- end }} - name: init-redis image: busybox:1.28 imagePullPolicy: {{ .Values.image.pullPolicy }} command: ["sh", "-c", "until nslookup {{ template "chatwoot.redis.host" . }} ; do echo waiting for {{ template "chatwoot.redis.host" . }} ; sleep 2; done;"] + {{- if .Values.securityContext }} + securityContext: {{ .Values.securityContext | toYaml | nindent 8 }} + {{- end }} containers: - name: "db-migrate-job" image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" @@ -80,9 +86,12 @@ spec: volumeMounts: - name: cache mountPath: /app/tmp + {{- if .Values.securityContext }} + securityContext: {{ .Values.securityContext | toYaml | nindent 8 }} + {{- end }} serviceAccountName: {{ include "chatwoot.serviceAccountName" . }} - {{- if .Values.securityContext }} - securityContext: {{ .Values.securityContext | toYaml | nindent 8 }} + {{- if .Values.podSecurityContext }} + securityContext: {{ .Values.podSecurityContext | toYaml | nindent 8 }} {{- end }} volumes: - name: cache diff --git a/charts/chatwoot/templates/tests/test-connection.yaml b/charts/chatwoot/templates/tests/test-connection.yaml index dd3eed9..825d5b9 100644 --- a/charts/chatwoot/templates/tests/test-connection.yaml +++ b/charts/chatwoot/templates/tests/test-connection.yaml @@ -24,4 +24,10 @@ spec: imagePullPolicy: IfNotPresent command: ['wget'] args: ['{{ include "chatwoot.fullname" . }}:{{ .Values.services.targetPort }}'] + {{- if .Values.securityContext }} + securityContext: {{ .Values.securityContext | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.podSecurityContext }} + securityContext: {{ .Values.podSecurityContext | toYaml | nindent 8 }} + {{- end }} restartPolicy: Never diff --git a/charts/chatwoot/templates/web-deployment.yaml b/charts/chatwoot/templates/web-deployment.yaml index 9e2fbda..ae9641f 100644 --- a/charts/chatwoot/templates/web-deployment.yaml +++ b/charts/chatwoot/templates/web-deployment.yaml @@ -83,6 +83,9 @@ spec: resources: {{- toYaml . | nindent 12 }} {{- end }} + {{- if .Values.securityContext }} + securityContext: {{ .Values.securityContext | toYaml | nindent 12 }} + {{- end }} livenessProbe: httpGet: path: /health @@ -106,8 +109,8 @@ spec: - name: cache mountPath: /app/tmp serviceAccountName: {{ include "chatwoot.serviceAccountName" . }} - {{- if .Values.securityContext }} - securityContext: {{ .Values.securityContext | toYaml | nindent 8 }} + {{- if .Values.podSecurityContext }} + securityContext: {{ .Values.podSecurityContext | toYaml | nindent 8 }} {{- end }} volumes: - name: cache diff --git a/charts/chatwoot/templates/worker-deployment.yaml b/charts/chatwoot/templates/worker-deployment.yaml index 1e55b19..5055e08 100644 --- a/charts/chatwoot/templates/worker-deployment.yaml +++ b/charts/chatwoot/templates/worker-deployment.yaml @@ -75,13 +75,16 @@ spec: resources: {{- toYaml . | nindent 12 }} {{- end }} + {{- if .Values.securityContext }} + securityContext: {{ .Values.securityContext | toYaml | nindent 12 }} + {{- end }} imagePullPolicy: {{ .Values.image.pullPolicy }} volumeMounts: - name: cache mountPath: /app/tmp serviceAccountName: {{ include "chatwoot.serviceAccountName" . }} - {{- if .Values.securityContext }} - securityContext: {{ .Values.securityContext | toYaml | nindent 8 }} + {{- if .Values.podSecurityContext }} + securityContext: {{ .Values.podSecurityContext | toYaml | nindent 8 }} {{- end }} volumes: - name: cache From 761c1ece58385194739c34da9ec95602420fe44f Mon Sep 17 00:00:00 2001 From: Jan <46779261+98jan@users.noreply.github.com> Date: Thu, 12 Mar 2026 20:02:46 +0100 Subject: [PATCH 2/3] fix: version bump to allow upgrade --- charts/chatwoot/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/chatwoot/Chart.yaml b/charts/chatwoot/Chart.yaml index 211b092..1aa8849 100644 --- a/charts/chatwoot/Chart.yaml +++ b/charts/chatwoot/Chart.yaml @@ -34,7 +34,7 @@ sources: - http://www.chatwoot.com # This is the chart version. -version: 2.0.17 +version: 2.0.18 # This is the application version. From 846c547eb91c58d28e51023fa98f0e8120ce1748 Mon Sep 17 00:00:00 2001 From: 98jan Date: Thu, 12 Mar 2026 20:11:17 +0100 Subject: [PATCH 3/3] fix: correct intendation for securityContext --- charts/chatwoot/templates/migrations-job.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/chatwoot/templates/migrations-job.yaml b/charts/chatwoot/templates/migrations-job.yaml index 7b07e7f..0c146eb 100644 --- a/charts/chatwoot/templates/migrations-job.yaml +++ b/charts/chatwoot/templates/migrations-job.yaml @@ -43,14 +43,14 @@ spec: done; echo "Database ready to accept connections." ; {{- if .Values.securityContext }} - securityContext: {{ .Values.securityContext | toYaml | nindent 8 }} + securityContext: {{ .Values.securityContext | toYaml | nindent 10 }} {{- end }} - name: init-redis image: busybox:1.28 imagePullPolicy: {{ .Values.image.pullPolicy }} command: ["sh", "-c", "until nslookup {{ template "chatwoot.redis.host" . }} ; do echo waiting for {{ template "chatwoot.redis.host" . }} ; sleep 2; done;"] {{- if .Values.securityContext }} - securityContext: {{ .Values.securityContext | toYaml | nindent 8 }} + securityContext: {{ .Values.securityContext | toYaml | nindent 10 }} {{- end }} containers: - name: "db-migrate-job" @@ -87,7 +87,7 @@ spec: - name: cache mountPath: /app/tmp {{- if .Values.securityContext }} - securityContext: {{ .Values.securityContext | toYaml | nindent 8 }} + securityContext: {{ .Values.securityContext | toYaml | nindent 10 }} {{- end }} serviceAccountName: {{ include "chatwoot.serviceAccountName" . }} {{- if .Values.podSecurityContext }}