CEML-293: Set PodSecurityContext for mysql (#151)

mlrun · Dec 8, 2024 · c489cac · c489cac
1 parent 21e97fd
commit c489cac
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 1 deletion.
diff --git a/charts/mlrun-ce/Chart.yaml b/charts/mlrun-ce/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: mlrun-ce
-version: 0.7.1-rc3
+version: 0.7.1-rc4
 description: MLRun Open Source Stack
 home: https://iguazio.com
 icon: https://www.iguazio.com/wp-content/uploads/2019/10/Iguazio-Logo.png

diff --git a/charts/mlrun-ce/templates/pipelines/deployments/mysql.yaml b/charts/mlrun-ce/templates/pipelines/deployments/mysql.yaml
@@ -23,6 +23,10 @@ spec:
         app: mysql
         application-crd-id: kubeflow-pipelines
     spec:
+      {{- if .Values.pipelines.db.securityContext }}
+      securityContext:
+{{ .Values.pipelines.db.securityContext | toYaml | indent 8 }}
+      {{- end }}
       containers:
       - args:
         {{- if semverCompare "~5.7" (.Values.pipelines.images.mysql.tag | toString) }}

diff --git a/charts/mlrun-ce/values.yaml b/charts/mlrun-ce/values.yaml
@@ -299,6 +299,11 @@ pipelines:
     #    effect: NoSchedule
   db:
     username: root
+    securityContext:
+      runAsUser: 1001
+      runAsGroup: 1001
+      fsGroup: 1001
+      fsGroupChangePolicy: OnRootMismatch
   minio:
     enabled: true
     accessKey: "minio"