Minor Helm chart dependency updates and security improvements

charts/hapi-fhir-jpaserver/templates/deployment.yaml

@@ -30,18 +30,12 @@ spec:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       initContainers:
         - name: wait-for-db-to-be-ready
-          image: docker.io/bitnami/postgresql:14.3.0-debian-10-r20
+          image: docker.io/bitnami/postgresql:14.5.0@sha256:4355265e33e9c2a786aa145884d4b36ffd4c41c516b35d60df0b7495141ec738
           imagePullPolicy: IfNotPresent
+          {{- with .Values.restrictedContainerSecurityContext }}
           securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            privileged: false
-            capabilities:
-              drop:
-                - ALL
-            runAsNonRoot: true
-            runAsUser: 1001
-            runAsGroup: 1001
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           env:
             - name: PGHOST
               value: "{{ include "hapi-fhir-jpaserver.database.host" . }}"
@@ -60,13 +54,13 @@ spec:
         - name: {{ .Chart.Name }}
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}
+          image: {{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
             - name: http
               containerPort: 8080
               protocol: TCP
-            - name: metrics
+            - name: http-metrics
               containerPort: 8081
               protocol: TCP
           startupProbe:

charts/hapi-fhir-jpaserver/templates/service.yaml

@@ -12,8 +12,8 @@ spec:
       protocol: TCP
       name: http
     - port: {{ .Values.metrics.service.port }}
-      targetPort: metrics
+      targetPort: http-metrics
       protocol: TCP
-      name: metrics
+      name: http-metrics
   selector:
     {{- include "hapi-fhir-jpaserver.selectorLabels" . | nindent 4 }}

charts/hapi-fhir-jpaserver/templates/servicemonitor.yaml

@@ -13,7 +13,7 @@ metadata:
     {{- end }}
 spec:
   endpoints:
-    - port: metrics
+    - port: http-metrics
       path: /actuator/prometheus
       {{- if .Values.metrics.serviceMonitor.interval }}
       interval: {{ .Values.metrics.serviceMonitor.interval }}

charts/hapi-fhir-jpaserver/templates/tests/test-endpoints.yaml

@@ -11,17 +11,13 @@ spec:
   restartPolicy: Never
   containers:
     - name: test-metadata-endpoint
-      image: busybox:1
-      command: ['wget', '-O', '-']
-      args: ['http://{{ include "hapi-fhir-jpaserver.fullname" . }}:{{ .Values.service.port }}/fhir/metadata']
+      image: docker.io/curlimages/curl:7.84.0@sha256:5a2a25d96aa941ea2fc47acc50122f7c3d007399a075df61a82d6d2c3a567a2b
+      command: ["curl", "--fail-with-body"]
+      args: ["http://{{ include "hapi-fhir-jpaserver.fullname" . }}:{{ .Values.service.port }}/fhir/metadata?_summary=true"]
+      {{- with .Values.restrictedContainerSecurityContext }}
       securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-            - ALL
-        readOnlyRootFilesystem: true
-        runAsUser: 22222
-        runAsNonRoot: true
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       resources:
         limits:
           cpu: 100m
@@ -36,17 +32,34 @@ spec:
         exec:
           command: ["true"]
     - name: test-patient-endpoint
-      image: busybox:1
-      command: ['wget', '-O', '-']
-      args: ['http://{{ include "hapi-fhir-jpaserver.fullname" . }}:{{ .Values.service.port }}/fhir/Patient?_count=1']
+      image: docker.io/curlimages/curl:7.84.0@sha256:5a2a25d96aa941ea2fc47acc50122f7c3d007399a075df61a82d6d2c3a567a2b
+      command: ["curl", "--fail-with-body"]
+      args: ["http://{{ include "hapi-fhir-jpaserver.fullname" . }}:{{ .Values.service.port }}/fhir/Patient?_count=1&_summary=true"]
+      {{- with .Values.restrictedContainerSecurityContext }}
       securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-            - ALL
-        readOnlyRootFilesystem: true
-        runAsUser: 22222
-        runAsNonRoot: true
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      resources:
+        limits:
+          cpu: 100m
+          memory: 128Mi
+        requests:
+          cpu: 100m
+          memory: 128Mi
+      livenessProbe:
+        exec:
+          command: ["true"]
+      readinessProbe:
+        exec:
+          command: ["true"]
+    - name: test-metrics-endpoint
+      image: docker.io/curlimages/curl:7.84.0@sha256:5a2a25d96aa941ea2fc47acc50122f7c3d007399a075df61a82d6d2c3a567a2b
+      command: ["curl", "--fail-with-body"]
+      args: ["http://{{ include "hapi-fhir-jpaserver.fullname" . }}:{{ .Values.metrics.service.port }}/actuator/prometheus"]
+      {{- with .Values.restrictedContainerSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       resources:
         limits:
           cpu: 100m