From 3d04f4abca35f7065ca335a52544e1e6c2cc9ba2 Mon Sep 17 00:00:00 2001 From: eli Date: Tue, 9 Sep 2025 20:41:15 -0700 Subject: [PATCH 1/7] Openshift support --- charts/pdp/Chart.yaml | 13 +++- charts/pdp/templates/deployment.yaml | 89 +++++++++++++++++++++++- charts/pdp/templates/serviceaccount.yaml | 29 ++++++++ charts/pdp/values.yaml | 44 ++++++++++-- 4 files changed, 167 insertions(+), 8 deletions(-) create mode 100644 charts/pdp/templates/serviceaccount.yaml diff --git a/charts/pdp/Chart.yaml b/charts/pdp/Chart.yaml index ea16aae0..20322cf2 100644 --- a/charts/pdp/Chart.yaml +++ b/charts/pdp/Chart.yaml @@ -1,4 +1,13 @@ apiVersion: v2 name: pdp -description: An official Helm chart for Permit.io PDP (Policy Decision Point) -version: 0.0.4 +description: An official Helm chart for Permit.io PDP (Policy Decision Point) with OpenShift support +version: 0.0.5 +keywords: + - policy + - authorization + - security + - permit + - openshift +maintainers: + - name: Permit.io + url: https://permit.io diff --git a/charts/pdp/templates/deployment.yaml b/charts/pdp/templates/deployment.yaml index 47ad4802..14236937 100644 --- a/charts/pdp/templates/deployment.yaml +++ b/charts/pdp/templates/deployment.yaml @@ -22,10 +22,83 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} spec: + {{- if .Values.openshift.enabled }} + serviceAccountName: {{ .Values.openshift.serviceAccount.name }} + # OpenShift-compatible pod security context + securityContext: + {{- if .Values.openshift.securityContext.pod.runAsNonRoot }} + runAsNonRoot: {{ .Values.openshift.securityContext.pod.runAsNonRoot }} + {{- end }} + {{- if .Values.openshift.securityContext.pod.runAsUser }} + runAsUser: {{ .Values.openshift.securityContext.pod.runAsUser }} + {{- end }} + {{- if .Values.openshift.securityContext.pod.runAsGroup }} + runAsGroup: {{ .Values.openshift.securityContext.pod.runAsGroup }} + {{- end }} + {{- if .Values.openshift.securityContext.pod.fsGroup }} + fsGroup: {{ .Values.openshift.securityContext.pod.fsGroup }} + {{- end }} + seccompProfile: + type: RuntimeDefault + {{- else }} + # Standard Kubernetes security context + securityContext: + {{- if .Values.securityContext.standard.pod.runAsNonRoot }} + runAsNonRoot: {{ .Values.securityContext.standard.pod.runAsNonRoot }} + {{- end }} + {{- if .Values.securityContext.standard.pod.runAsUser }} + runAsUser: {{ .Values.securityContext.standard.pod.runAsUser }} + {{- end }} + {{- if .Values.securityContext.standard.pod.runAsGroup }} + runAsGroup: {{ .Values.securityContext.standard.pod.runAsGroup }} + {{- end }} + {{- if .Values.securityContext.standard.pod.fsGroup }} + fsGroup: {{ .Values.securityContext.standard.pod.fsGroup }} + {{- end }} + seccompProfile: + type: RuntimeDefault + {{- end }} containers: - name: permitio-pdp image: "{{ .Values.pdp.image.repository }}:{{ .Values.pdp.image.tag }}" imagePullPolicy: {{ .Values.pdp.image.pullPolicy }} + {{- if .Values.openshift.enabled }} + # OpenShift-compatible container security context + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + {{- if .Values.openshift.securityContext.container.runAsNonRoot }} + runAsNonRoot: {{ .Values.openshift.securityContext.container.runAsNonRoot }} + {{- end }} + {{- if .Values.openshift.securityContext.container.runAsUser }} + runAsUser: {{ .Values.openshift.securityContext.container.runAsUser }} + {{- end }} + {{- if .Values.openshift.securityContext.container.runAsGroup }} + runAsGroup: {{ .Values.openshift.securityContext.container.runAsGroup }} + {{- end }} + seccompProfile: + type: RuntimeDefault + {{- else }} + # Standard Kubernetes container security context + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + {{- if .Values.securityContext.standard.container.runAsNonRoot }} + runAsNonRoot: {{ .Values.securityContext.standard.container.runAsNonRoot }} + {{- end }} + {{- if .Values.securityContext.standard.container.runAsUser }} + runAsUser: {{ .Values.securityContext.standard.container.runAsUser }} + {{- end }} + {{- if .Values.securityContext.standard.container.runAsGroup }} + runAsGroup: {{ .Values.securityContext.standard.container.runAsGroup }} + {{- end }} + seccompProfile: + type: RuntimeDefault + {{- end }} ports: - containerPort: {{ .Values.pdp.port }} env: @@ -90,10 +163,16 @@ spec: port: 7000 initialDelaySeconds: 10 periodSeconds: 10 - {{- if .Values.pdp.logs_forwarder.enabled }} volumeMounts: + {{- if .Values.pdp.logs_forwarder.enabled }} - name: logs mountPath: /tmp/ + {{- else if .Values.openshift.enabled }} + # OpenShift filesystem permissions volume mounts + - name: tmp-volume + mountPath: /tmp + - name: opa-volume + mountPath: /opa {{- end }} {{- if .Values.pdp.logs_forwarder.enabled }} - name: fluentbit @@ -110,11 +189,17 @@ spec: fieldRef: fieldPath: metadata.labels['app'] {{- end }} - {{- if .Values.pdp.logs_forwarder.enabled }} volumes: + {{- if .Values.pdp.logs_forwarder.enabled }} - name: fluent-bit-config configMap: name: fluentbit-config - name: logs emptyDir: {} + {{- else if .Values.openshift.enabled }} + # OpenShift filesystem permissions volumes + - name: tmp-volume + emptyDir: {} + - name: opa-volume + emptyDir: {} {{- end }} diff --git a/charts/pdp/templates/serviceaccount.yaml b/charts/pdp/templates/serviceaccount.yaml new file mode 100644 index 00000000..06cf754b --- /dev/null +++ b/charts/pdp/templates/serviceaccount.yaml @@ -0,0 +1,29 @@ +{{- if and .Values.openshift.enabled .Values.openshift.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .Values.openshift.serviceAccount.name }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "pdp.labels" . | nindent 4 }} +{{- end }} + +{{- if and .Values.openshift.enabled .Values.openshift.serviceAccount.create }} +--- +# RoleBinding to allow the ServiceAccount to use the specified SCC +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ .Values.openshift.serviceAccount.name }}-scc-binding + namespace: {{ .Release.Namespace }} + labels: + {{- include "pdp.labels" . | nindent 4 }} +subjects: +- kind: ServiceAccount + name: {{ .Values.openshift.serviceAccount.name }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: system:openshift:scc:{{ .Values.openshift.serviceAccount.sccName }} + apiGroup: rbac.authorization.k8s.io +{{- end }} \ No newline at end of file diff --git a/charts/pdp/values.yaml b/charts/pdp/values.yaml index d632c2e0..45d3ea57 100644 --- a/charts/pdp/values.yaml +++ b/charts/pdp/values.yaml @@ -3,10 +3,9 @@ annotations: {} pdp: pdpEnvs: - [] - # - name: custom_env - # value: "custom_env" - ApiKey: "" + - name: PDP_CONTROL_PLANE + value: "http://permit-backend-v2:8000" + ApiKey: "permit_key_kymHPKiIiUGklAMnSJfqEE9YRNCsFn52SQzFO2eCnwLfnEgQ7kg8HvuV7MOedG30IfGinaAgq9nYSoJTOArJf6" # Use an existing secret for the API key instead of creating one # If defined, the chart will not create a secret and will use this existing secret # existingApiKeySecret: @@ -41,3 +40,40 @@ resources: memory: "512Mi" limits: memory: "1Gi" + +# OpenShift configuration +openshift: + enabled: false # Set to true for OpenShift deployments + # ServiceAccount configuration for OpenShift compatibility + serviceAccount: + create: true + name: "permitio-pdp-sa" + sccName: "restricted-v2" # OpenShift Security Context Constraint + # Security context configuration for OpenShift + securityContext: + # Pod security context (applied to all containers in pod) + pod: + runAsNonRoot: true + # runAsUser: null # OpenShift SCC assigns UID automatically + # runAsGroup: null # OpenShift SCC assigns GID automatically + # fsGroup: null # OpenShift SCC assigns fsGroup automatically + # Container security context (applied to individual containers) + container: + runAsNonRoot: true + # runAsUser: null # OpenShift SCC assigns UID automatically + # runAsGroup: null # OpenShift SCC assigns GID automatically + +# Standard Kubernetes security contexts (used when openshift.enabled: false) +securityContext: + standard: + # Pod security context (applied to all containers in pod) + pod: + runAsNonRoot: true + runAsUser: 1001 + runAsGroup: 1001 + fsGroup: 1001 + # Container security context (applied to individual containers) + container: + runAsNonRoot: true + runAsUser: 1001 + runAsGroup: 1001 From 14d7055b196927e2715dc39aabcff31b7e92e22f Mon Sep 17 00:00:00 2001 From: eli Date: Mon, 15 Sep 2025 17:11:00 -0700 Subject: [PATCH 2/7] openshift support added --- charts/pdp/values.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/charts/pdp/values.yaml b/charts/pdp/values.yaml index 45d3ea57..f8564a6c 100644 --- a/charts/pdp/values.yaml +++ b/charts/pdp/values.yaml @@ -3,9 +3,11 @@ annotations: {} pdp: pdpEnvs: - - name: PDP_CONTROL_PLANE - value: "http://permit-backend-v2:8000" - ApiKey: "permit_key_kymHPKiIiUGklAMnSJfqEE9YRNCsFn52SQzFO2eCnwLfnEgQ7kg8HvuV7MOedG30IfGinaAgq9nYSoJTOArJf6" + [] + # - name: custom_env + # value: "custom_env" + ApiKey: "" + # Use an existing secret for the API key instead of creating one # If defined, the chart will not create a secret and will use this existing secret # existingApiKeySecret: From 53537639a65f15bc3118c1db2953311d29cce010 Mon Sep 17 00:00:00 2001 From: eli Date: Mon, 15 Sep 2025 17:12:49 -0700 Subject: [PATCH 3/7] openshift --- charts/pdp/templates/deployment.yaml | 69 ++++------------------------ charts/pdp/values.yaml | 32 ++----------- 2 files changed, 15 insertions(+), 86 deletions(-) diff --git a/charts/pdp/templates/deployment.yaml b/charts/pdp/templates/deployment.yaml index 14236937..efc4c343 100644 --- a/charts/pdp/templates/deployment.yaml +++ b/charts/pdp/templates/deployment.yaml @@ -24,81 +24,32 @@ spec: spec: {{- if .Values.openshift.enabled }} serviceAccountName: {{ .Values.openshift.serviceAccount.name }} - # OpenShift-compatible pod security context - securityContext: - {{- if .Values.openshift.securityContext.pod.runAsNonRoot }} - runAsNonRoot: {{ .Values.openshift.securityContext.pod.runAsNonRoot }} - {{- end }} - {{- if .Values.openshift.securityContext.pod.runAsUser }} - runAsUser: {{ .Values.openshift.securityContext.pod.runAsUser }} - {{- end }} - {{- if .Values.openshift.securityContext.pod.runAsGroup }} - runAsGroup: {{ .Values.openshift.securityContext.pod.runAsGroup }} - {{- end }} - {{- if .Values.openshift.securityContext.pod.fsGroup }} - fsGroup: {{ .Values.openshift.securityContext.pod.fsGroup }} - {{- end }} - seccompProfile: - type: RuntimeDefault - {{- else }} - # Standard Kubernetes security context + {{- end }} securityContext: - {{- if .Values.securityContext.standard.pod.runAsNonRoot }} - runAsNonRoot: {{ .Values.securityContext.standard.pod.runAsNonRoot }} - {{- end }} - {{- if .Values.securityContext.standard.pod.runAsUser }} - runAsUser: {{ .Values.securityContext.standard.pod.runAsUser }} - {{- end }} - {{- if .Values.securityContext.standard.pod.runAsGroup }} - runAsGroup: {{ .Values.securityContext.standard.pod.runAsGroup }} - {{- end }} - {{- if .Values.securityContext.standard.pod.fsGroup }} - fsGroup: {{ .Values.securityContext.standard.pod.fsGroup }} + runAsNonRoot: {{ .Values.securityContext.runAsNonRoot }} + {{- if not .Values.openshift.enabled }} + runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} + fsGroup: {{ .Values.securityContext.fsGroup }} {{- end }} seccompProfile: type: RuntimeDefault - {{- end }} containers: - name: permitio-pdp image: "{{ .Values.pdp.image.repository }}:{{ .Values.pdp.image.tag }}" imagePullPolicy: {{ .Values.pdp.image.pullPolicy }} - {{- if .Values.openshift.enabled }} - # OpenShift-compatible container security context securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL - {{- if .Values.openshift.securityContext.container.runAsNonRoot }} - runAsNonRoot: {{ .Values.openshift.securityContext.container.runAsNonRoot }} - {{- end }} - {{- if .Values.openshift.securityContext.container.runAsUser }} - runAsUser: {{ .Values.openshift.securityContext.container.runAsUser }} - {{- end }} - {{- if .Values.openshift.securityContext.container.runAsGroup }} - runAsGroup: {{ .Values.openshift.securityContext.container.runAsGroup }} - {{- end }} - seccompProfile: - type: RuntimeDefault - {{- else }} - # Standard Kubernetes container security context - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - {{- if .Values.securityContext.standard.container.runAsNonRoot }} - runAsNonRoot: {{ .Values.securityContext.standard.container.runAsNonRoot }} - {{- end }} - {{- if .Values.securityContext.standard.container.runAsUser }} - runAsUser: {{ .Values.securityContext.standard.container.runAsUser }} - {{- end }} - {{- if .Values.securityContext.standard.container.runAsGroup }} - runAsGroup: {{ .Values.securityContext.standard.container.runAsGroup }} + runAsNonRoot: {{ .Values.securityContext.runAsNonRoot }} + {{- if not .Values.openshift.enabled }} + runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} {{- end }} seccompProfile: type: RuntimeDefault - {{- end }} ports: - containerPort: {{ .Values.pdp.port }} env: diff --git a/charts/pdp/values.yaml b/charts/pdp/values.yaml index f8564a6c..8d55da61 100644 --- a/charts/pdp/values.yaml +++ b/charts/pdp/values.yaml @@ -46,36 +46,14 @@ resources: # OpenShift configuration openshift: enabled: false # Set to true for OpenShift deployments - # ServiceAccount configuration for OpenShift compatibility serviceAccount: create: true name: "permitio-pdp-sa" sccName: "restricted-v2" # OpenShift Security Context Constraint - # Security context configuration for OpenShift - securityContext: - # Pod security context (applied to all containers in pod) - pod: - runAsNonRoot: true - # runAsUser: null # OpenShift SCC assigns UID automatically - # runAsGroup: null # OpenShift SCC assigns GID automatically - # fsGroup: null # OpenShift SCC assigns fsGroup automatically - # Container security context (applied to individual containers) - container: - runAsNonRoot: true - # runAsUser: null # OpenShift SCC assigns UID automatically - # runAsGroup: null # OpenShift SCC assigns GID automatically -# Standard Kubernetes security contexts (used when openshift.enabled: false) +# Security context (OpenShift SCC will override user/group settings when openshift.enabled: true) securityContext: - standard: - # Pod security context (applied to all containers in pod) - pod: - runAsNonRoot: true - runAsUser: 1001 - runAsGroup: 1001 - fsGroup: 1001 - # Container security context (applied to individual containers) - container: - runAsNonRoot: true - runAsUser: 1001 - runAsGroup: 1001 + runAsNonRoot: true + runAsUser: 1001 + runAsGroup: 1001 + fsGroup: 1001 From e95221b41686412dcf5e9259e0c520ff58576df0 Mon Sep 17 00:00:00 2001 From: eli Date: Mon, 15 Sep 2025 19:37:40 -0700 Subject: [PATCH 4/7] pre commit fix --- charts/pdp/templates/serviceaccount.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/pdp/templates/serviceaccount.yaml b/charts/pdp/templates/serviceaccount.yaml index 06cf754b..1109f9f9 100644 --- a/charts/pdp/templates/serviceaccount.yaml +++ b/charts/pdp/templates/serviceaccount.yaml @@ -26,4 +26,4 @@ roleRef: kind: ClusterRole name: system:openshift:scc:{{ .Values.openshift.serviceAccount.sccName }} apiGroup: rbac.authorization.k8s.io -{{- end }} \ No newline at end of file +{{- end }} From fa1ccb71b2928fabda53d05d136f6fed124e4e72 Mon Sep 17 00:00:00 2001 From: eli Date: Mon, 15 Sep 2025 20:37:10 -0700 Subject: [PATCH 5/7] fix securityContext --- charts/pdp/templates/deployment.yaml | 25 +++++++++---------------- charts/pdp/values.yaml | 13 ++++++------- 2 files changed, 15 insertions(+), 23 deletions(-) diff --git a/charts/pdp/templates/deployment.yaml b/charts/pdp/templates/deployment.yaml index efc4c343..4ed18111 100644 --- a/charts/pdp/templates/deployment.yaml +++ b/charts/pdp/templates/deployment.yaml @@ -24,32 +24,25 @@ spec: spec: {{- if .Values.openshift.enabled }} serviceAccountName: {{ .Values.openshift.serviceAccount.name }} - {{- end }} securityContext: - runAsNonRoot: {{ .Values.securityContext.runAsNonRoot }} - {{- if not .Values.openshift.enabled }} - runAsUser: {{ .Values.securityContext.runAsUser }} - runAsGroup: {{ .Values.securityContext.runAsGroup }} - fsGroup: {{ .Values.securityContext.fsGroup }} - {{- end }} + runAsNonRoot: {{ .Values.openshift.securityContext.runAsNonRoot }} seccompProfile: type: RuntimeDefault + {{- end }} containers: - name: permitio-pdp image: "{{ .Values.pdp.image.repository }}:{{ .Values.pdp.image.tag }}" imagePullPolicy: {{ .Values.pdp.image.pullPolicy }} + {{- if .Values.openshift.enabled }} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL - runAsNonRoot: {{ .Values.securityContext.runAsNonRoot }} - {{- if not .Values.openshift.enabled }} - runAsUser: {{ .Values.securityContext.runAsUser }} - runAsGroup: {{ .Values.securityContext.runAsGroup }} - {{- end }} + runAsNonRoot: {{ .Values.openshift.securityContext.runAsNonRoot }} seccompProfile: type: RuntimeDefault + {{- end }} ports: - containerPort: {{ .Values.pdp.port }} env: @@ -118,8 +111,8 @@ spec: {{- if .Values.pdp.logs_forwarder.enabled }} - name: logs mountPath: /tmp/ - {{- else if .Values.openshift.enabled }} - # OpenShift filesystem permissions volume mounts + {{- else }} + # Writable volume mounts for application data - name: tmp-volume mountPath: /tmp - name: opa-volume @@ -147,8 +140,8 @@ spec: name: fluentbit-config - name: logs emptyDir: {} - {{- else if .Values.openshift.enabled }} - # OpenShift filesystem permissions volumes + {{- else }} + # Writable volumes for application data - name: tmp-volume emptyDir: {} - name: opa-volume diff --git a/charts/pdp/values.yaml b/charts/pdp/values.yaml index 8d55da61..5dbe7693 100644 --- a/charts/pdp/values.yaml +++ b/charts/pdp/values.yaml @@ -50,10 +50,9 @@ openshift: create: true name: "permitio-pdp-sa" sccName: "restricted-v2" # OpenShift Security Context Constraint - -# Security context (OpenShift SCC will override user/group settings when openshift.enabled: true) -securityContext: - runAsNonRoot: true - runAsUser: 1001 - runAsGroup: 1001 - fsGroup: 1001 + # Security context (SCC will override user/group settings automatically) + securityContext: + runAsNonRoot: true + runAsUser: 1001 + runAsGroup: 1001 + fsGroup: 1001 From 75cb931ea792b38b8a69e6ad30b997d074f38cd8 Mon Sep 17 00:00:00 2001 From: eli Date: Tue, 16 Sep 2025 13:29:36 -0700 Subject: [PATCH 6/7] fix path volume --- charts/pdp/templates/deployment.yaml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/charts/pdp/templates/deployment.yaml b/charts/pdp/templates/deployment.yaml index 4ed18111..816d5983 100644 --- a/charts/pdp/templates/deployment.yaml +++ b/charts/pdp/templates/deployment.yaml @@ -26,6 +26,9 @@ spec: serviceAccountName: {{ .Values.openshift.serviceAccount.name }} securityContext: runAsNonRoot: {{ .Values.openshift.securityContext.runAsNonRoot }} + runAsUser: {{ .Values.openshift.securityContext.runAsUser }} + runAsGroup: {{ .Values.openshift.securityContext.runAsGroup }} + fsGroup: {{ .Values.openshift.securityContext.fsGroup }} seccompProfile: type: RuntimeDefault {{- end }} @@ -40,6 +43,8 @@ spec: drop: - ALL runAsNonRoot: {{ .Values.openshift.securityContext.runAsNonRoot }} + runAsUser: {{ .Values.openshift.securityContext.runAsUser }} + runAsGroup: {{ .Values.openshift.securityContext.runAsGroup }} seccompProfile: type: RuntimeDefault {{- end }} @@ -111,8 +116,8 @@ spec: {{- if .Values.pdp.logs_forwarder.enabled }} - name: logs mountPath: /tmp/ - {{- else }} - # Writable volume mounts for application data + {{- else if .Values.openshift.enabled }} + # OpenShift requires explicit writable volumes - name: tmp-volume mountPath: /tmp - name: opa-volume @@ -140,8 +145,8 @@ spec: name: fluentbit-config - name: logs emptyDir: {} - {{- else }} - # Writable volumes for application data + {{- else if .Values.openshift.enabled }} + # OpenShift writable volumes - name: tmp-volume emptyDir: {} - name: opa-volume From 2bea558b00ada469fe0c4712618923916c8e78c8 Mon Sep 17 00:00:00 2001 From: eli Date: Tue, 16 Sep 2025 13:32:59 -0700 Subject: [PATCH 7/7] fix permissions issue --- charts/pdp/templates/deployment.yaml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/charts/pdp/templates/deployment.yaml b/charts/pdp/templates/deployment.yaml index 816d5983..307de1ee 100644 --- a/charts/pdp/templates/deployment.yaml +++ b/charts/pdp/templates/deployment.yaml @@ -26,9 +26,6 @@ spec: serviceAccountName: {{ .Values.openshift.serviceAccount.name }} securityContext: runAsNonRoot: {{ .Values.openshift.securityContext.runAsNonRoot }} - runAsUser: {{ .Values.openshift.securityContext.runAsUser }} - runAsGroup: {{ .Values.openshift.securityContext.runAsGroup }} - fsGroup: {{ .Values.openshift.securityContext.fsGroup }} seccompProfile: type: RuntimeDefault {{- end }} @@ -43,8 +40,6 @@ spec: drop: - ALL runAsNonRoot: {{ .Values.openshift.securityContext.runAsNonRoot }} - runAsUser: {{ .Values.openshift.securityContext.runAsUser }} - runAsGroup: {{ .Values.openshift.securityContext.runAsGroup }} seccompProfile: type: RuntimeDefault {{- end }}