DevOps/truecharts
2
0
Fork 0
Code Issues Pull Requests Actions 33 Packages Projects Releases 1 Wiki Activity
Files
main
truecharts/charts/stable/guacamole/values.yaml
T
LorenzoGParisiandGitHub 11817fd01c fix(guacamole): modified GUACD GID to resolve guacd security context issue allow read access to the recordings volume (#46870) 
**Description**
<!--
Please include a summary of the change and which issue is fixed. Please
also include relevant motivation and context. List any dependencies that
are required for this change.
-->
⚒️ Fixes a permission issue within the `guacd` security context that
prevented the correct display of video recordings in the UI. By aligning
the GID of `guacd` with `guacamole`, both services now have the
necessary read access to the shared recordings persistence volume.

**⚙️ Type of change**

- [ ] ⚙️ Feature/App addition
- [x] 🪛 Bugfix
- [ ] ⚠️ Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] 🔃 Refactor of current code
- [ ] 📜 Documentation Changes

**🧪 How Has This Been Tested?**
<!--
Please describe the tests that you ran to verify your changes. Provide
instructions so we can reproduce. Please also list any relevant details
for your test configuration
-->
Verified that video recordings are correctly accessible and playable
within the Guacamole UI after applying the GID alignment, otherwise not.
**📃 Notes:**
<!-- Please enter any other relevant information here -->
The fix involves the following configuration change:
```yaml
  guacd:
    podSpec:
      containers:
        guacd:
          securityContext:
            runAsUser: 1000
            runAsGroup: 1001 # modified: the gid for both guacamole and guacd must be the same.
```

**✔️ Checklist:**

- [x] ⚖️ My code follows the style guidelines of this project
- [x] 👀 I have performed a self-review of my own code
- [ ] #️⃣ I have commented my code, particularly in hard-to-understand
areas
- [ ] 📄 I have made changes to the documentation
- [ ] 🧪 I have added tests to this description that prove my fix is
effective or that my feature works
- [x] ⬆️ I increased versions for any altered app according to semantic
versioning
- [x] I made sure the title starts with `feat(chart-name):`,
`fix(chart-name):`, `chore(chart-name):`, `docs(chart-name):` or
`fix(docs):`

**➕ App addition**

If this PR is an app addition please make sure you have done the
following.

- [ ] 🖼️ I have added an icon in the Chart's root directory called
`icon.png`

---

_Please don't blindly check all the boxes. Read them and only check
those that apply.
Those checkboxes are there for the reviewer to see what is this all
about and
the status of this PR with a quick glance._
2026-04-14 07:03:36 +02:00

261 lines
6.7 KiB
YAML
Raw Permalink Blame History

# yaml-language-server: $schema=./values.schema.json
image:
repository: docker.io/guacamole/guacamole
pullPolicy: IfNotPresent
tag: 1.6.0@sha256:f344085e618bb05e22b964b0208dbd06d3468275bac70206f93805245e067b40
guacdImage:
repository: docker.io/guacamole/guacd
pullPolicy: IfNotPresent
tag: 1.6.0@sha256:8974eaa9ba32f713daf311e7cc8cd7e4cdfba1edea39eed75524e78ef4b08f4f
guacamole:
general:
EXTENSION_PRIORITY: ""
api:
API_SESSION_TIMEOUT: 60
ldap: {}
# LDAP_HOSTNAME: ""
# LDAP_USER_BASE_DN: ""
# LDAP_PORT: 389
# LDAP_ENCRYPTION_METHOD: none
# LDAP_MAX_SEARCH_RESULTS: 1000
# LDAP_SEARCH_BIND_DN: ""
# LDAP_USER_ATTRIBUTES: ""
# LDAP_SEARCH_BIND_PASSWORD: ""
# LDAP_USERNAME_ATTRIBUTE: uid
# LDAP_MEMBER_ATTRIBUTE: member
# LDAP_USER_SEARCH_FILTER: "(objectClass=*)"
# LDAP_CONFIG_BASE_DN: ""
# LDAP_GROUP_BASE_DN: ""
# LDAP_GROUP_SEARCH_FILTER: "(objectClass=*)"
# LDAP_MEMBER_ATTRIBUTE_TYPE: dn
# LDAP_GROUP_NAME_ATTRIBUTE: cn
# LDAP_DEREFERENCE_ALIASES: never
# LDAP_FOLLOW_REFERRALS: false
# LDAP_MAX_REFERRAL_HOPS: 5
# LDAP_OPERATION_TIMEOUT: 30
header: {}
# HEADER_ENABLED: false
# HTTP_AUTH_HEADER: REMOTE_USER
saml: {}
# SAML_IDP_METADATA_URL: ""
# SAML_IDP_URL: ""
# SAML_ENTITY_ID: ""
# SAML_CALLBACK_URL: ""
# SAML_STRICT: true
# SAML_DEBUG: false
# SAML_COMPRESS_REQUEST: true
# SAML_COMPRESS_RESPONSE: true
# SAML_GROUP_ATTRIBUTE: groups
proxy: {}
# REMOTE_IP_VALVE_ENABLED: false
# PROXY_ALLOWED_IPS_REGEX: ""
# PROXY_IP_HEADER: ""
# PROXY_PROTOCOL_HEADER: ""
# PROXY_BY_HEADER: ""
totp: {}
# TOTP_ENABLED: false
# TOTP_ISSUER: Apache Guacamole
# TOTP_DIGITS: 6
# TOTP_PERIOD: 30
# TOTP_MODE: sha1
duo: {}
# DUO_API_HOSTNAME: ""
# DUO_CLIENT_ID: ""
# DUO_CLIENT_SECRET: ""
# DUO_REDIRECT_URI: ""
radius: {}
# RADIUS_SHARED_SECRET: ""
# RADIUS_AUTH_PROTOCOL: eap-tls
# RADIUS_HOSTNAME: ""
# RADIUS_AUTH_PORT: 1812
# RADIUS_KEY_FILE: ""
# RADIUS_KEY_TYPE: pkcs12
# RADIUS_KEY_PASSWORD: ""
# RADIUS_CA_FILE: ""
# RADIUS_CA_TYPE: pem
# RADIUS_CA_PASSWORD: ""
# RADIUS_TRUST_ALL: false
# RADIUS_RETRIES: 5
# RADIUS_TIMEOUT: 60
# RADIUS_EAP_TTLS_INNER_PROTOCOL: eap-tls
# RADIUS_NAS_IP: ""
openid: {}
# OPENID_AUTHORIZATION_ENDPOINT: ""
# OPENID_JWKS_ENDPOINT: ""
# OPENID_ISSUER: ""
# OPENID_CLIENT_ID: ""
# OPENID_REDIRECT_URI: ""
# OPENID_USERNAME_CLAIM_TYPE: email
# OPENID_GROUPS_CLAIM_TYPE: groups
# OPENID_SCOPE: openid email profile
# OPENID_ALLOWED_CLOCK_SKEW: 30
# OPENID_MAX_TOKEN_VALIDITY: 300
# OPENID_MAX_NONCE_VALIDITY: 300
cas: {}
# CAS_AUTHORIZATION_ENDPOINT: ""
# CAS_REDIRECT_URI: ""
# CAS_CLEARPASS_KEY: ""
# CAS_GROUP_ATTRIBUTE: ""
# CAS_GROUP_FORMAT: plain
# CAS_GROUP_LDAP_BASE_DN: ""
# CAS_GROUP_LDAP_ATTRIBUTE: ""
json: {}
# JSON_SECRET_KEY: ""
# JSON_TRUSTED_NETWORKS: ""
workload:
main:
podSpec:
containers:
main:
securityContext:
runAsUser: 1001
runAsGroup: 1001
readOnlyRootFilesystem: false
envFrom:
- configMapRef:
name: guacamole-config
probes:
liveness:
type: http
port: "{{ .Values.service.main.ports.main.targetPort }}"
readiness:
type: http
port: "{{ .Values.service.main.ports.main.targetPort }}"
startup:
type: tcp
port: "{{ .Values.service.main.ports.main.targetPort }}"
# zz is used to ensure that the initContainers are run after db-waits
initContainers:
1-create-seed:
enabled: true
type: install
imageSelector: image
securityContext:
runAsUser: 1001
runAsGroup: 1001
readOnlyRootFilesystem: false
envFrom:
- configMapRef:
name: guacamole-config
command:
- /bin/sh
args:
- -c
- /tc-scripts/create-seed.sh
2-apply-seed:
enabled: true
type: install
imageSelector: postgresClientImage
securityContext:
runAsUser: 1001
runAsGroup: 1001
readOnlyRootFilesystem: false
envFrom:
- configMapRef:
name: guacamole-config
command:
- /bin/sh
args:
- -c
- /tc-scripts/apply-seed.sh
guacd:
enabled: true
type: Deployment
strategy: RollingUpdate
podSpec:
containers:
guacd:
enabled: true
primary: true
imageSelector: guacdImage
command:
- /opt/guacamole/sbin/guacd
args:
# Listen Address
- -b
- "0.0.0.0"
# Listen Port
- -l
- "{{ .Values.service.guacd.ports.guacd.port }}"
# Log Level
- -L
- info
# Foreground
- -f
securityContext:
runAsUser: 1000
runAsGroup: 1001
readOnlyRootFilesystem: false
probes:
liveness:
type: tcp
port: "{{ .Values.service.guacd.ports.guacd.port }}"
readiness:
type: tcp
port: "{{ .Values.service.guacd.ports.guacd.port }}"
startup:
type: tcp
port: "{{ .Values.service.guacd.ports.guacd.port }}"
service:
main:
ports:
main:
port: 10123
targetPort: 8080
guacd:
enabled: true
targetSelector: guacd
ports:
guacd:
enabled: true
targetSelector: guacd
port: 10124
persistence:
recordings:
enabled: true
# Check how this works and
# which containers need it mounted
targetSelector:
main:
main:
mountPath: /var/lib/guacamole/recordings
readOnly: true
guacd:
guacd:
mountPath: /var/lib/guacamole/recordings
drive:
enabled: true
targetSelector:
guacd:
guacd:
mountPath: /var/lib/guacamole/drive
tc-init:
enabled: true
type: emptyDir
targetSelector:
main:
1-create-seed:
mountPath: /tc-init
2-apply-seed:
mountPath: /tc-init
db-seed:
enabled: true
type: configmap
objectName: db-init
defaultMode: "0770"
targetSelector:
main:
1-create-seed:
mountPath: /tc-scripts/create-seed.sh
subPath: create-seed.sh
2-apply-seed:
mountPath: /tc-scripts/apply-seed.sh
subPath: apply-seed.sh
cnpg:
main:
enabled: true
user: guacamole
database: guacamole
updated: true
Reference in New Issue View Git Blame Copy Permalink