Allow all containers in the kubeflow namespace to run as non root

apps/pipeline/upstream/installs/multi-user/pipelines-profile-controller/deployment.yaml

@@ -36,7 +36,7 @@ spec:
         - name: hooks
           mountPath: /hooks
         ports:
-        - containerPort: 80
+        - containerPort: 8080
       volumes:
       - name: hooks
         configMap:

apps/pipeline/upstream/installs/multi-user/pipelines-profile-controller/service.yaml

@@ -7,4 +7,4 @@ spec:
   - name: http
     port: 80
     protocol: TCP
-    targetPort: 80
+    targetPort: 8080

apps/pipeline/upstream/installs/multi-user/pipelines-profile-controller/sync.py

@@ -266,4 +266,4 @@ def do_POST(self):
         self.wfile.write(bytes(json.dumps(desired), 'utf-8'))
 
 
-HTTPServer(("", 80), Controller).serve_forever()
+HTTPServer(("", 8080), Controller).serve_forever()

apps/pipeline/upstream/mysql/base/deployment.yaml

@@ -10,15 +10,21 @@ spec:
       annotations:
         sidecar.istio.io/inject: "false"
     spec:
+      serviceAccountName: mysql
       containers:
-      - name: mysql
+      - args:
+        - --datadir
+        - /var/lib/mysql/datadir
         env:
         - name: MYSQL_ALLOW_EMPTY_PASSWORD
           value: "true"
-        image: mysql:5.6
+        image: mysql:5.7
+        imagePullPolicy: IfNotPresent
+        name: mysql
         ports:
         - containerPort: 3306
           name: mysql
+          protocol: TCP
         volumeMounts:
         - mountPath: /var/lib/mysql
           name: mysql-persistent-storage

apps/pipeline/upstream/mysql/base/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
 - deployment.yaml
 - service.yaml
 - persistent-volume-claim.yaml
+- serviceaccount.yaml
 configMapGenerator:
 - name: pipeline-mysql-parameters
   envs:

apps/pipeline/upstream/mysql/base/serviceaccount.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mysql

contrib/metadata/overlays/db/metadata-db-deployment.yaml

@@ -21,7 +21,7 @@ spec:
     spec:
       containers:
       - name: db-container
-        image: mysql:8.0.3
+        image: mysql:8.0
         args:
         - --datadir
         - /var/lib/mysql/datadir
@@ -38,7 +38,7 @@ spec:
             command:
             - "/bin/bash"
             - "-c"
-            - "mysql -D $$MYSQL_DATABASE -p$$MYSQL_ROOT_PASSWORD -e 'SELECT 1'"
+            - "mysql --database=$MYSQL_DATABASE --password=$MYSQL_ROOT_PASSWORD --user=$MYSQL_USER_NAME -e 'SELECT 1'"
           initialDelaySeconds: 5
           periodSeconds: 2
           timeoutSeconds: 1

distributions/stacks/openshift/application/metadata/patchdb.yaml

@@ -1,3 +1,3 @@
 - op: replace
   path: /spec/template/spec/containers/0/readinessProbe/exec/command/2
-  value: "mysql -D $$MYSQL_DATABASE -u$$MYSQL_USER_NAME -p$$MYSQL_ROOT_PASSWORD -e 'SELECT 1'" 
+  value: "mysql --database=$MYSQL_DATABASE --password=$MYSQL_ROOT_PASSWORD --user=$MYSQL_USER_NAME -e 'SELECT 1" 

tests/stacks/openshift/application/metadata/test_data/expected/apps_v1_deployment_metadata-db.yaml

@@ -42,8 +42,7 @@ spec:
             command:
             - /bin/bash
             - -c
-            - mysql -D $$MYSQL_DATABASE -u$$MYSQL_USER_NAME -p$$MYSQL_ROOT_PASSWORD
-              -e 'SELECT 1'
+            - mysql --database=$MYSQL_DATABASE --password=$MYSQL_ROOT_PASSWORD --user=$MYSQL_USER_NAME -e 'SELECT 1'
           initialDelaySeconds: 5
           periodSeconds: 2
           timeoutSeconds: 1