fix: bbolt data directory permissions (#151)

* create initContainer to set permissions for data directory if backend is bbolt

* create configMap with script to set permissions if backend is bbolt

* data dir permissions set to 0750

* bump chart minor version and generate docs

charts/bindplane/Chart.yaml

@@ -3,7 +3,7 @@ name: bindplane
 description: BindPlane OP is an observability pipeline.
 type: application
 # The chart's version
-version: 1.13.11
+version: 1.13.12
 # The BindPlane OP tagged release. If the user does not
 # set the `image.tag` values option, this version is used.
 appVersion: 1.69.0

charts/bindplane/README.md

@@ -1,6 +1,6 @@
 # bindplane
 
-![Version: 1.13.11](https://img.shields.io/badge/Version-1.13.11-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.69.0](https://img.shields.io/badge/AppVersion-1.69.0-informational?style=flat-square)
+![Version: 1.13.12](https://img.shields.io/badge/Version-1.13.12-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.69.0](https://img.shields.io/badge/AppVersion-1.69.0-informational?style=flat-square)
 
 BindPlane OP is an observability pipeline.
 
@@ -149,3 +149,5 @@ BindPlane OP is an observability pipeline.
 | transform_agent.replicas | int | `1` | Number of replicas to use for the transform agent. |
 | transform_agent.tag | string | `""` | Transform Agent Image tag to use. Defaults to latest. |
 
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

charts/bindplane/templates/bindplane.yaml

@@ -49,8 +49,22 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if .Values.backend.postgres.sslsecret.name }}
       initContainers:
+      {{- if eq .Values.backend.type "bbolt" }}
+        - name: set-data-permissions
+          image: busybox
+          command:
+          - sh
+          - -c
+          - /bin/sh /set-data-permissions.sh
+          volumeMounts:
+            - name: data-permissions-init
+              mountPath: /set-data-permissions.sh
+              subPath: set-data-permissions.sh
+            - name: {{ include "bindplane.fullname" . }}-data
+              mountPath: /data
+      {{- end }}
+      {{- if .Values.backend.postgres.sslsecret.name }}
         - name: postgres-tls
           image: busybox
           command:
@@ -584,6 +598,9 @@ spec:
             secretName: {{ .Values.prometheus.tls.secret.name }}
         {{- end }}
         {{- end }}
+        - name: data-permissions-init
+          configMap:
+            name: data-permissions-init
         {{- if .Values.backend.postgres.sslsecret.name }}
         - name: postgres-tls-dir
           emptyDir: {}

charts/bindplane/templates/configmap.yaml

@@ -1,3 +1,14 @@
+{{- if eq .Values.backend.type "bbolt" }}
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: data-permissions-init
+data:
+  set-data-permissions.sh: |
+    #!/bin/sh
+    chown -R 65534:65534 /data
+    chmod 0750 /data
+{{ end }}
 {{- if .Values.backend.postgres.sslsecret.name }}
 kind: ConfigMap
 apiVersion: v1