From 11e20b4715401fda9dce6d53a31d078e70e392ea Mon Sep 17 00:00:00 2001 From: Cesar Celis Hernandez Date: Mon, 13 Mar 2023 21:19:49 -0600 Subject: [PATCH] Allow empty securityContext (#1462) Let OpenShift pick its own users, don't hardcode them Co-authored-by: MinIO Bot --- .../statefulsets/minio-statefulset.go | 27 ++++++++++++++----- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/pkg/resources/statefulsets/minio-statefulset.go b/pkg/resources/statefulsets/minio-statefulset.go index 8496efce139..47ca5b2d6a8 100644 --- a/pkg/resources/statefulsets/minio-statefulset.go +++ b/pkg/resources/statefulsets/minio-statefulset.go @@ -424,28 +424,41 @@ func poolSecurityContext(pool *miniov2.Pool, status *miniov2.PoolStatus) *v1.Pod // Builds the security context for containers in a Pool func poolContainerSecurityContext(pool *miniov2.Pool) *v1.SecurityContext { + // Default values: + // By default, values should be totally empty if not provided + // This is specially needed in OpenShift where Security Context Constraints restrict them + // if let empty then OCP can pick the values from the constraints defined. + containerSecurityContext := corev1.SecurityContext{} runAsNonRoot := true var runAsUser int64 = 1000 var runAsGroup int64 = 1000 - // Default to Pod values + poolSCSet := false + + // Values from pool.SecurityContext ONLY if provided if pool.SecurityContext != nil { if pool.SecurityContext.RunAsNonRoot != nil { runAsNonRoot = *pool.SecurityContext.RunAsNonRoot + poolSCSet = true } if pool.SecurityContext.RunAsUser != nil { runAsUser = *pool.SecurityContext.RunAsUser + poolSCSet = true } if pool.SecurityContext.RunAsGroup != nil { runAsGroup = *pool.SecurityContext.RunAsGroup + poolSCSet = true + } + if poolSCSet { + // Only set values if one of above is set otherwise let it empty + containerSecurityContext = corev1.SecurityContext{ + RunAsNonRoot: &runAsNonRoot, + RunAsUser: &runAsUser, + RunAsGroup: &runAsGroup, + } } } - containerSecurityContext := corev1.SecurityContext{ - RunAsNonRoot: &runAsNonRoot, - RunAsUser: &runAsUser, - RunAsGroup: &runAsGroup, - } - + // Values from pool.ContainerSecurityContext if provided if pool != nil && pool.ContainerSecurityContext != nil { containerSecurityContext = *pool.ContainerSecurityContext }