Add runAsGroup in SecurityContext (helm#101) (helm#21174)

Signed-off-by: devOpsHelm <devops+1@hazelcast.com>
quantopian · Jul 13, 2020 · 1c071f4 · 1c071f4
1 parent bf80144
commit 1c071f4
Show file tree

Hide file tree

Showing 7 changed files with 12 additions and 1 deletion.
diff --git a/stable/hazelcast-jet/Chart.yaml b/stable/hazelcast-jet/Chart.yaml
@@ -4,7 +4,7 @@ tillerVersion: ">=2.7.2"
 kubeVersion: ">=1.9.0-0"
 description: Hazelcast Jet is an application embeddable, distributed computing engine built on top of Hazelcast In-Memory Data Grid (IMDG). With Hazelcast IMDG providing storage functionality, Hazelcast Jet performs parallel execution to enable data-intensive applications to operate in near real-time.
 name: hazelcast-jet
-version: 1.3.1
+version: 1.3.2
 keywords:
 - hazelcast
 - jet

diff --git a/stable/hazelcast-jet/README.adoc b/stable/hazelcast-jet/README.adoc
@@ -167,6 +167,9 @@ Hazelcast Jet Management Center |`+true+`
 |`+securityContext.runAsUser+` |User ID used to run the Hazelcast Jet and
 Hazelcast Jet Management Center containers |`+1001+`
 
+| `securityContext.runAsGroup` |Primary Group ID used to run all processes in the
+ Hazelcast Jet and Hazelcast Jet Management Center containers | `+65534+`
+
 |`+securityContext.fsGroup+` |Group ID associated with the Hazelcast Jet and
 Hazelcast Jet Management Center container |`+1001+`
 

diff --git a/stable/hazelcast-jet/templates/management-center-deployment.yaml b/stable/hazelcast-jet/templates/management-center-deployment.yaml
@@ -39,6 +39,7 @@ spec:
       {{- if .Values.securityContext.enabled }}
       securityContext:
         runAsUser: {{ .Values.securityContext.runAsUser }}
+        runAsGroup: {{ .Values.securityContext.runAsGroup }}
         fsGroup: {{ .Values.securityContext.fsGroup }}
       {{- end }}
       containers:

diff --git a/stable/hazelcast-jet/templates/statefulset.yaml b/stable/hazelcast-jet/templates/statefulset.yaml
@@ -88,6 +88,7 @@ spec:
       {{- if .Values.securityContext.enabled }}
       securityContext:
         runAsUser: {{ .Values.securityContext.runAsUser }}
+        runAsGroup: {{ .Values.securityContext.runAsGroup }}
         fsGroup: {{ .Values.securityContext.fsGroup }}
       {{- end }}
       volumes:

diff --git a/stable/hazelcast-jet/templates/tests/test-hazelcast-jet.yaml b/stable/hazelcast-jet/templates/tests/test-hazelcast-jet.yaml
@@ -19,6 +19,7 @@ spec:
   securityContext:
     runAsNonRoot: true
     runAsUser: 1001
+    runAsGroup: 1001
   {{- if .Values.nodeSelector }}
   nodeSelector:
 {{ toYaml .Values.nodeSelector | indent 4 }}
@@ -38,6 +39,7 @@ spec:
     securityContext:
       runAsNonRoot: true
       runAsUser: 1001
+      runAsGroup: 1001
       privileged: false
       readOnlyRootFilesystem: true
       allowPrivilegeEscalation: false

diff --git a/stable/hazelcast-jet/templates/tests/test-management-center.yaml b/stable/hazelcast-jet/templates/tests/test-management-center.yaml
@@ -19,6 +19,7 @@ spec:
   securityContext:
     runAsNonRoot: true
     runAsUser: 1001
+    runAsGroup: 1001
   {{- if .Values.nodeSelector }}
   nodeSelector:
 {{ toYaml .Values.nodeSelector | indent 4 }}
@@ -37,6 +38,7 @@ spec:
     securityContext:
       runAsNonRoot: true
       runAsUser: 1001
+      runAsGroup: 1001
       privileged: false
       readOnlyRootFilesystem: true
       allowPrivilegeEscalation: false

diff --git a/stable/hazelcast-jet/values.yaml b/stable/hazelcast-jet/values.yaml
@@ -157,6 +157,8 @@ securityContext:
   enabled: true
   # runAsUser is the user ID used to run the container
   runAsUser: 1001
+  # runAsGroup is the primary group ID used to run all processes within any container of the pod
+  runAsGroup: 1001
   # fsGroup is the group ID associated with the container
   fsGroup: 1001