fix: ass fsGroup for sts

GluuFederation · Jan 11, 2023 · 3158281 · 3158281
1 parent 0451de1
commit 3158281
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 6 deletions.
diff --git a/pygluu/kubernetes/templates/helm/gluu/charts/opendj/templates/cronjobs.yaml b/pygluu/kubernetes/templates/helm/gluu/charts/opendj/templates/cronjobs.yaml
@@ -15,12 +15,14 @@ spec:
           dnsConfig:
     {{ toYaml . | indent 12 }}
         {{- end }}
+          securityContext:
+            runAsUser: 1000
+            runAsNonRoot: true
+            fsGroup: 1000
+            #fsGroupChangePolicy: "OnRootMismatch" enable once 1.23 is the lowest version
           containers:
             - name: {{ include "opendj.fullname" . }}-backup
               image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-              securityContext:
-                runAsUser: 1000
-                runAsNonRoot: true
               envFrom:
                 - configMapRef:
                     name: {{ .Release.Name }}-config-cm

diff --git a/pygluu/kubernetes/templates/helm/gluu/charts/opendj/templates/statefulset.yaml b/pygluu/kubernetes/templates/helm/gluu/charts/opendj/templates/statefulset.yaml
@@ -50,13 +50,15 @@ spec:
       topologySpreadConstraints:
         {{- include "opendj.topology-spread-constraints" . | indent 8 }}
       {{- end }}
+      securityContext:
+        runAsUser: 1000
+        runAsNonRoot: true
+        fsGroup: 1000
+        #fsGroupChangePolicy: "OnRootMismatch" enable once 1.23 is the lowest version
       containers:
       - name: {{ include "opendj.name" $ }}
         imagePullPolicy: {{ $.Values.image.pullPolicy }}
         image: "{{ $.Values.image.repository }}:{{ $.Values.image.tag }}"
-        securityContext:
-          runAsUser: 1000
-          runAsNonRoot: true
         env:
           {{- include "opendj.usr-envs" $ | indent 12 }}
           {{- include "opendj.usr-secret-envs" $ | indent 12 }}