Skip to content

Add customizable securityContext #532

@xhejtman

Description

@xhejtman

Description

While main components can set pod/container securityContext as needed, it is not settable for spawned statefulsets, where the security context is hardcoded and it is not sufficient for root-less environments.

Would it be possible to make it either settable or provide the rootless option where:

  1. init container is ommited (cannot do chown without root anyway)
  2. security context is set to:
securityContext: # Pod security context
  fsGroupChangePolicy: OnRootMismatch
  runAsNonRoot: true
  fsGroup: 1001 # this one will do the initcontainer job if the CSI driver is correctly configured
  seccompProfile:
    type: RuntimeDefault

and

securityContext: # Container security context
  runAsUser: 1001
  allowPrivilegeEscalation: false
  capabilities
    drop:
    - ALL

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions