(fix): Remove sudo privilege from helm-charts

- Change security context to anyuid
- Changed from deployment to job, now the pods will be in completed

charts/physims/charts/nr-pbchsim.217rb/values.yaml

@@ -27,10 +27,10 @@ podSecurityContext:
   runAsGroup: 0
 
 securityContext:
-  privileged: true
-  capabilities:
-    add:
-      - SYS_CAP_PTRACE
+  privileged: false
+#  capabilities:
+#    add:
+#      - SYS_CAP_PTRACE
   #   drop:
   #   - ALL
   # readOnlyRootFilesystem: true

charts/physims/charts/nr-pbchsim.273rb/templates/deployment.yaml → charts/physims/charts/nr-pbchsim.273rb/templates/job.yaml

-apiVersion: apps/v1
-kind: Deployment
+apiVersion: batch/v1
+kind: Job
 metadata:
   name: {{ .Chart.Name }}
-  labels:
-    {{- include "oai-nr-pbchsim-273rb.labels" . | nindent 4 }}
 spec:
-  replicas: {{ .Values.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "oai-nr-pbchsim-273rb.selectorLabels" . | nindent 6 }}
-  strategy:
-    type: Recreate
   template:
-    metadata:
-      labels:
-        {{- include "oai-nr-pbchsim-273rb.selectorLabels" . | nindent 8 }}
     spec:
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
@@ -28,8 +17,6 @@ spec:
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
-        ports:
-        - containerPort: 80
         env:
         - name: OPENAIR_DIR
           value: /opt/oai-physim
@@ -37,9 +24,9 @@ spec:
         args:
         - >
           cmake_targets/autotests/run_exec_autotests.bash -g "nr_pbchsim.273rb" -d bin/ &&
-          echo "FINISHED" && sleep infinity
+          echo "FINISHED"
       dnsPolicy: ClusterFirst
-      restartPolicy: Always
+      restartPolicy: Never
       schedulerName: default-scheduler
       serviceAccountName: {{ .Values.global.serviceAccountName }}
       terminationGracePeriodSeconds: 30

charts/physims/charts/nr-pbchsim.273rb/values.yaml

@@ -27,10 +27,10 @@ podSecurityContext:
   runAsGroup: 0
 
 securityContext:
-  privileged: true
-  capabilities:
-    add:
-      - SYS_CAP_PTRACE
+  privileged: false
+#  capabilities:
+#    add:
+#      - SYS_CAP_PTRACE
   #   drop:
   #   - ALL
   # readOnlyRootFilesystem: true

charts/physims/charts/nr-prachsim/templates/deployment.yaml → charts/physims/charts/nr-prachsim/templates/job.yaml

-apiVersion: apps/v1
-kind: Deployment
+apiVersion: batch/v1
+kind: Job
 metadata:
   name: {{ .Chart.Name }}
-  labels:
-    {{- include "oai-nr-prachsim.labels" . | nindent 4 }}
 spec:
-  replicas: {{ .Values.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "oai-nr-prachsim.selectorLabels" . | nindent 6 }}
-  strategy:
-    type: Recreate
   template:
-    metadata:
-      labels:
-        {{- include "oai-nr-prachsim.selectorLabels" . | nindent 8 }}
     spec:
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
@@ -28,8 +17,6 @@ spec:
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
-        ports:
-        - containerPort: 80
         env:
         - name: OPENAIR_DIR
           value: /opt/oai-physim
@@ -37,9 +24,9 @@ spec:
         args:
         - >  
           cmake_targets/autotests/run_exec_autotests.bash -g "nr_prachsim" -d bin/ &&
-          echo "FINISHED" && sleep infinity
+          echo "FINISHED" 
       dnsPolicy: ClusterFirst
-      restartPolicy: Always
+      restartPolicy: Never
       schedulerName: default-scheduler
       serviceAccountName: {{ .Values.global.serviceAccountName }}
       terminationGracePeriodSeconds: 30

charts/physims/charts/nr-prachsim/values.yaml

@@ -27,10 +27,10 @@ podSecurityContext:
   runAsGroup: 0
 
 securityContext:
-  privileged: true
-  capabilities:
-    add:
-      - SYS_CAP_PTRACE
+  privileged: false
+#  capabilities:
+#    add:
+#      - SYS_CAP_PTRACE
   #   drop:
   #   - ALL
   # readOnlyRootFilesystem: true

charts/physims/charts/nr-pucchsim/templates/deployment.yaml → charts/physims/charts/nr-pucchsim/templates/job.yaml

-apiVersion: apps/v1
-kind: Deployment
+apiVersion: batch/v1
+kind: Job
 metadata:
   name: {{ .Chart.Name }}
-  labels:
-    {{- include "oai-nr-pucchsim.labels" . | nindent 4 }}
 spec:
-  replicas: {{ .Values.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "oai-nr-pucchsim.selectorLabels" . | nindent 6 }}
-  strategy:
-    type: Recreate
   template:
-    metadata:
-      labels:
-        {{- include "oai-nr-pucchsim.selectorLabels" . | nindent 8 }}
     spec:
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
@@ -28,8 +17,6 @@ spec:
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
-        ports:
-        - containerPort: 80
         env:
         - name: OPENAIR_DIR
           value: /opt/oai-physim
@@ -37,9 +24,9 @@ spec:
         args:
         - >  
           cmake_targets/autotests/run_exec_autotests.bash -g "nr_pucchsim" -d bin/ &&
-          echo "FINISHED" && sleep infinity
+          echo "FINISHED"
       dnsPolicy: ClusterFirst
-      restartPolicy: Always
+      restartPolicy: Never
       schedulerName: default-scheduler
       serviceAccountName: {{ .Values.global.serviceAccountName }}
       terminationGracePeriodSeconds: 30

charts/physims/charts/nr-pucchsim/values.yaml

@@ -27,10 +27,10 @@ podSecurityContext:
   runAsGroup: 0
 
 securityContext:
-  privileged: true
-  capabilities:
-    add:
-      - SYS_CAP_PTRACE
+  privileged: false
+#  capabilities:
+#    add:
+#      - SYS_CAP_PTRACE
   #   drop:
   #   - ALL
   # readOnlyRootFilesystem: true

charts/physims/charts/nr-ulschsim/templates/deployment.yaml → charts/physims/charts/nr-ulschsim/templates/job.yaml

-apiVersion: apps/v1
-kind: Deployment
+apiVersion: batch/v1
+kind: Job
 metadata:
   name: {{ .Chart.Name }}
-  labels:
-    {{- include "oai-nr-ulschsim.labels" . | nindent 4 }}
 spec:
-  replicas: {{ .Values.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "oai-nr-ulschsim.selectorLabels" . | nindent 6 }}
-  strategy:
-    type: Recreate
   template:
-    metadata:
-      labels:
-        {{- include "oai-nr-ulschsim.selectorLabels" . | nindent 8 }}
     spec:
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
@@ -28,8 +17,6 @@ spec:
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
-        ports:
-        - containerPort: 80
         env:
         - name: OPENAIR_DIR
           value: /opt/oai-physim
@@ -37,9 +24,9 @@ spec:
         args:
         - >  
           cmake_targets/autotests/run_exec_autotests.bash -g "nr_ulschsim" -d bin/ &&
-          echo "FINISHED" && sleep infinity
+          echo "FINISHED"
       dnsPolicy: ClusterFirst
-      restartPolicy: Always
+      restartPolicy: Never
       schedulerName: default-scheduler
       serviceAccountName: {{ .Values.global.serviceAccountName }}
       terminationGracePeriodSeconds: 30

charts/physims/charts/nr-ulschsim/values.yaml

@@ -27,10 +27,10 @@ podSecurityContext:
   runAsGroup: 0
 
 securityContext:
-  privileged: true
-  capabilities:
-    add:
-      - SYS_CAP_PTRACE
+  privileged: false
+#  capabilities:
+#    add:
+#      - SYS_CAP_PTRACE
   #   drop:
   #   - ALL
   # readOnlyRootFilesystem: true

charts/physims/charts/nr-ulsim.3gpp/templates/deployment.yaml → charts/physims/charts/nr-ulsim.3gpp/templates/job.yaml

-apiVersion: apps/v1
-kind: Deployment
+apiVersion: batch/v1
+kind: Job
 metadata:
   name: {{ .Chart.Name }}
-  labels:
-    {{- include "oai-nr-ulsim-3gpp.labels" . | nindent 4 }}
 spec:
-  replicas: {{ .Values.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "oai-nr-ulsim-3gpp.selectorLabels" . | nindent 6 }}
-  strategy:
-    type: Recreate
   template:
-    metadata:
-      labels:
-        {{- include "oai-nr-ulsim-3gpp.selectorLabels" . | nindent 8 }}
     spec:
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
@@ -28,8 +17,6 @@ spec:
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
-        ports:
-        - containerPort: 80
         env:
         - name: OPENAIR_DIR
           value: /opt/oai-physim
@@ -37,9 +24,9 @@ spec:
         args:
         - >
           cmake_targets/autotests/run_exec_autotests.bash -g "nr_ulsim.3gpp" -d bin/ &&
-          echo "FINISHED" && sleep infinity
+          echo "FINISHED" 
       dnsPolicy: ClusterFirst
-      restartPolicy: Always
+      restartPolicy: Never
       schedulerName: default-scheduler
       serviceAccountName: {{ .Values.global.serviceAccountName }}
       terminationGracePeriodSeconds: 30

charts/physims/charts/nr-ulsim.3gpp/values.yaml

@@ -27,10 +27,10 @@ podSecurityContext:
   runAsGroup: 0
 
 securityContext:
-  privileged: true
-  capabilities:
-    add:
-      - SYS_CAP_PTRACE
+  privileged: false
+#  capabilities:
+#    add:
+#      - SYS_CAP_PTRACE
   #   drop:
   #   - ALL
   # readOnlyRootFilesystem: true

charts/physims/charts/nr-ulsim.mimo/templates/deployment.yaml → charts/physims/charts/nr-ulsim.mimo/templates/job.yaml

-apiVersion: apps/v1
-kind: Deployment
+apiVersion: batch/v1
+kind: Job
 metadata:
   name: {{ .Chart.Name }}
-  labels:
-    {{- include "oai-nr-ulsim-mimo.labels" . | nindent 4 }}
 spec:
-  replicas: {{ .Values.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "oai-nr-ulsim-mimo.selectorLabels" . | nindent 6 }}
-  strategy:
-    type: Recreate
   template:
-    metadata:
-      labels:
-        {{- include "oai-nr-ulsim-mimo.selectorLabels" . | nindent 8 }}
     spec:
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
@@ -28,8 +17,6 @@ spec:
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
-        ports:
-        - containerPort: 80
         env:
         - name: OPENAIR_DIR
           value: /opt/oai-physim
@@ -37,9 +24,9 @@ spec:
         args:
         - >
           cmake_targets/autotests/run_exec_autotests.bash -g "nr_ulsim.mimo" -d bin/ &&
-          echo "FINISHED" && sleep infinity
+          echo "FINISHED"
       dnsPolicy: ClusterFirst
-      restartPolicy: Always
+      restartPolicy: Never
       schedulerName: default-scheduler
       serviceAccountName: {{ .Values.global.serviceAccountName }}
       terminationGracePeriodSeconds: 30

charts/physims/charts/nr-ulsim.mimo/values.yaml

@@ -27,10 +27,10 @@ podSecurityContext:
   runAsGroup: 0
 
 securityContext:
-  privileged: true
-  capabilities:
-    add:
-      - SYS_CAP_PTRACE
+  privileged: false
+#  capabilities:
+#    add:
+#      - SYS_CAP_PTRACE
   #   drop:
   #   - ALL
   # readOnlyRootFilesystem: true

charts/physims/charts/nr-ulsim.misc/templates/deployment.yaml → charts/physims/charts/nr-ulsim.misc/templates/job.yaml

-apiVersion: apps/v1
-kind: Deployment
+apiVersion: batch/v1
+kind: Job
 metadata:
   name: {{ .Chart.Name }}
-  labels:
-    {{- include "oai-nr-ulsim-misc.labels" . | nindent 4 }}
 spec:
-  replicas: {{ .Values.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "oai-nr-ulsim-misc.selectorLabels" . | nindent 6 }}
-  strategy:
-    type: Recreate
   template:
-    metadata:
-      labels:
-        {{- include "oai-nr-ulsim-misc.selectorLabels" . | nindent 8 }}
     spec:
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
@@ -28,8 +17,6 @@ spec:
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
-        ports:
-        - containerPort: 80
         env:
         - name: OPENAIR_DIR
           value: /opt/oai-physim
@@ -37,9 +24,9 @@ spec:
         args:
         - >
           cmake_targets/autotests/run_exec_autotests.bash -g "nr_ulsim.misc" -d bin/ &&
-          echo "FINISHED" && sleep infinity
+          echo "FINISHED"
       dnsPolicy: ClusterFirst
-      restartPolicy: Always
+      restartPolicy: Never
       schedulerName: default-scheduler
       serviceAccountName: {{ .Values.global.serviceAccountName }}
       terminationGracePeriodSeconds: 30

charts/physims/charts/nr-ulsim.misc/values.yaml

@@ -27,10 +27,10 @@ podSecurityContext:
   runAsGroup: 0
 
 securityContext:
-  privileged: true
-  capabilities:
-    add:
-      - SYS_CAP_PTRACE
+  privileged: false
+#  capabilities:
+#    add:
+#      - SYS_CAP_PTRACE
   #   drop:
   #   - ALL
   # readOnlyRootFilesystem: true

charts/physims/charts/nr-ulsim.sc-fdma/templates/deployment.yaml → charts/physims/charts/nr-ulsim.sc-fdma/templates/job.yaml

-apiVersion: apps/v1
-kind: Deployment
+apiVersion: batch/v1
+kind: Job
 metadata:
   name: {{ .Chart.Name }}
-  labels:
-    {{- include "oai-nr-ulsim-sc-fdma.labels" . | nindent 4 }}
 spec:
-  replicas: {{ .Values.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "oai-nr-ulsim-sc-fdma.selectorLabels" . | nindent 6 }}
-  strategy:
-    type: Recreate
   template:
-    metadata:
-      labels:
-        {{- include "oai-nr-ulsim-sc-fdma.selectorLabels" . | nindent 8 }}
     spec:
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
@@ -37,9 +26,9 @@ spec:
         args:
         - >
           cmake_targets/autotests/run_exec_autotests.bash -g "nr_ulsim.sc-fdma" -d bin/ &&
-          echo "FINISHED" && sleep infinity
+          echo "FINISHED" 
       dnsPolicy: ClusterFirst
-      restartPolicy: Always
+      restartPolicy: Never
       schedulerName: default-scheduler
       serviceAccountName: {{ .Values.global.serviceAccountName }}
       terminationGracePeriodSeconds: 30

charts/physims/charts/nr-ulsim.sc-fdma/values.yaml

@@ -27,10 +27,10 @@ podSecurityContext:
   runAsGroup: 0
 
 securityContext:
-  privileged: true
-  capabilities:
-    add:
-      - SYS_CAP_PTRACE
+  privileged: false
+#  capabilities:
+#    add:
+#      - SYS_CAP_PTRACE
   #   drop:
   #   - ALL
   # readOnlyRootFilesystem: true

charts/physims/charts/polartest/templates/deployment.yaml → charts/physims/charts/polartest/templates/job.yaml

-apiVersion: apps/v1
-kind: Deployment
+apiVersion: batch/v1
+kind: Job
 metadata:
   name: {{ .Chart.Name }}
-  labels:
-    {{- include "oai-polartest.labels" . | nindent 4 }}
 spec:
-  replicas: {{ .Values.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "oai-polartest.selectorLabels" . | nindent 6 }}
-  strategy:
-    type: Recreate
   template:
-    metadata:
-      labels:
-        {{- include "oai-polartest.selectorLabels" . | nindent 8 }}
     spec:
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
@@ -28,8 +17,6 @@ spec:
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
-        ports:
-        - containerPort: 80
         env:
         - name: OPENAIR_DIR
           value: /opt/oai-physim
@@ -37,9 +24,9 @@ spec:
         args:
         - >  
           cmake_targets/autotests/run_exec_autotests.bash -g "polartest" -d bin/ &&
-          echo "FINISHED" && sleep infinity
+          echo "FINISHED"
       dnsPolicy: ClusterFirst
-      restartPolicy: Always
+      restartPolicy: Never
       schedulerName: default-scheduler
       serviceAccountName: {{ .Values.global.serviceAccountName }}
       terminationGracePeriodSeconds: 30

charts/physims/charts/polartest/values.yaml

@@ -27,10 +27,10 @@ podSecurityContext:
   runAsGroup: 0
 
 securityContext:
-  privileged: true
-  capabilities:
-    add:
-      - SYS_CAP_PTRACE
+  privileged: false
+#  capabilities:
+#    add:
+#      - SYS_CAP_PTRACE
   #   drop:
   #   - ALL
   # readOnlyRootFilesystem: true

charts/physims/charts/smallblocktest/templates/deployment.yaml → charts/physims/charts/smallblocktest/templates/job.yaml

-apiVersion: apps/v1
-kind: Deployment
+apiVersion: batch/v1
+kind: Job
 metadata:
   name: {{ .Chart.Name }}
-  labels:
-    {{- include "oai-smallblocktest.labels" . | nindent 4 }}
 spec:
-  replicas: {{ .Values.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "oai-smallblocktest.selectorLabels" . | nindent 6 }}
-  strategy:
-    type: Recreate
   template:
-    metadata:
-      labels:
-        {{- include "oai-smallblocktest.selectorLabels" . | nindent 8 }}
     spec:
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
@@ -28,8 +17,6 @@ spec:
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
-        ports:
-        - containerPort: 80
         env:
         - name: OPENAIR_DIR
           value: /opt/oai-physim
@@ -37,9 +24,9 @@ spec:
         args:
         - >  
           cmake_targets/autotests/run_exec_autotests.bash -g "smallblocktest" -d bin/ &&
-          echo "FINISHED" && sleep infinity
+          echo "FINISHED"
       dnsPolicy: ClusterFirst
-      restartPolicy: Always
+      restartPolicy: Never
       schedulerName: default-scheduler
       serviceAccountName: {{ .Values.global.serviceAccountName }}
       terminationGracePeriodSeconds: 30