feat: adjust spec.template.spec.securityContext (#465)

* Move runAsNonRoot to values.yaml and add support for runAsUser/runAsGroup Signed-off-by: ChristianBieri1995 <[email protected]> * Adjust spec.template.spec.securityContext Signed-off-by: ChristianBieri1995 <[email protected]> --------- Signed-off-by: ChristianBieri1995 <[email protected]> Co-authored-by: Aris Boutselis <[email protected]> Co-authored-by: Alex Jones <[email protected]>
k8sgpt-ai · Oct 22, 2024 · e92a69f · e92a69f
1 parent 0727ec6
commit e92a69f
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/chart/operator/templates/deployment.yaml b/chart/operator/templates/deployment.yaml
@@ -98,8 +98,10 @@ spec:
           }}
         securityContext: {{- toYaml .Values.controllerManager.manager.containerSecurityContext
           | nindent 10 }}
+      {{- if .Values.controllerManager.podSecurityContext }}
       securityContext:
-        runAsNonRoot: true
+      {{- toYaml .Values.controllerManager.podSecurityContext | nindent 8 }}
+      {{- end }}
       serviceAccountName: {{ include "chart.fullname" . }}-controller-manager
       terminationGracePeriodSeconds: 10
     {{- if .Values.controllerManager.nodeSelector }}

diff --git a/chart/operator/values.yaml b/chart/operator/values.yaml
@@ -63,6 +63,11 @@ controllerManager:
   ## ref: https://kubernetes.io/docs/user-guide/node-selection/
   #
   nodeSelector: {}
+  podSecurityContext:
+    runAsNonRoot: true
+    # Set securityContext.runAsUser/runAsGroup if necessary. Values below were taken from https://github.com/k8sgpt-ai/k8sgpt-operator/blob/main/Dockerfile
+    # runAsUser: 65532
+    # runAsGroup: 65532
 kubernetesClusterDomain: cluster.local
 metricsService:
   ports: