mirrors/garage
1
0
Fork 0
mirror of https://git.deuxfleurs.fr/Deuxfleurs/garage.git synced 2024-11-25 01:21:01 +00:00
Code Issues Projects Releases Packages Wiki Activity

fix(helm): file permission issues when running as non-root user

Browse source 
Specify the user group for the garage (and init) process and ensure
that the persistent storage is mounted with the correct file system
group
This commit is contained in:
Patrick Jahns 2022-11-16 21:46:43 +01:00 committed by Maximilien Richer
parent da6f7b0dda
commit fd03b184b3
No known key found for this signature in database
GPG key ID: 04FD5063D6D43365
2 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
script/helm/garage/templates/workload.yaml
View file

@ -41,6 +41,8 @@ spec:
secretKeyRef: secretKeyRef:
name: {{ include "garage.rpcSecretName" . }} name: {{ include "garage.rpcSecretName" . }}
key: rpcSecret key: rpcSecret
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
volumeMounts: volumeMounts:
- name: configmap - name: configmap
mountPath: /mnt/garage.toml mountPath: /mnt/garage.toml

9
script/helm/garage/values.yaml
View file

@ -92,8 +92,11 @@ serviceAccount:
podAnnotations: {} podAnnotations: {}
podSecurityContext: {} podSecurityContext:
# fsGroup: 2000 runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
runAsNonRoot: true
securityContext: securityContext:
# The default security context is heavily restricted # The default security context is heavily restricted
@ -102,8 +105,6 @@ securityContext:
drop: drop:
- ALL - ALL
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
service: service:
# You can rely on any service to expose your cluster # You can rely on any service to expose your cluster