Make the deployment and the jobs run in a non-root environment

VERSION

@@ -1 +1 @@
-0.0.11
+0.0.12

build/Dockerfile

@@ -7,4 +7,7 @@ RUN make build
 FROM alpine:3.13.4 as base
 COPY --from=builder /go/src/github.com/ysoftdevs/imagepullsecret-injector/build/_output/bin/imagepullsecret-injector /usr/local/bin/imagepullsecret-injector
 
-ENTRYPOINT ["imagepullsecret-injector"]
+RUN addgroup -S imagepullsecret-injector-group && adduser -S imagepullsecret-injector-user -G imagepullsecret-injector-group
+USER imagepullsecret-injector-user
+
+ENTRYPOINT ["imagepullsecret-injector"]

build/Dockerfile.cert-generator

@@ -1,6 +1,9 @@
 FROM alpine:3.13.4
 
-RUN apk add bash curl openssl \
+RUN addgroup -S imagepullsecret-injector-group && adduser -S imagepullsecret-injector-user -G imagepullsecret-injector-group \
+    && apk add bash curl openssl jq \
     && curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
     && chmod 755 ./kubectl \
     && mv ./kubectl /usr/bin/kubectl
+
+USER imagepullsecret-injector-user

charts/imagepullsecret-injector/Chart.yaml

@@ -20,4 +20,4 @@ version: 0.0.21
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 0.0.11
+appVersion: 0.0.12

charts/imagepullsecret-injector/scripts/create-signed-cert.sh

@@ -84,10 +84,10 @@ kubectl delete csr ${csrName} 2>/dev/null || true
 
 echo "Creating new CertificateSigningRequests"
 # create server cert/key CSR and  send to k8s API
-jq -n --arg request "$(< "${tmpdir}"/server.csr base64 -w0)" \
+jq -n --arg request "$(< "${tmpdir}"/server.csr base64)" \
   --arg namespace "$namespace" \
   --arg csrName "$csrName" '{
-    apiVersion: "certificates.k8s.io/v1beta1",
+    apiVersion: "certificates.k8s.io/v1",
     kind: "CertificateSigningRequest",
     metadata: {
       name: $csrName,