make pod security context fully configurable #186
Conversation
|
Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla |
CatherineThompson
force-pushed
the
ct-pod-security-context
branch
from
bbe335f
to
ede48f2
Compare
|
Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla |
CatherineThompson
force-pushed
the
ct-pod-security-context
branch
from
ede48f2
to
fa91d19
Compare
|
Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla |
CatherineThompson
force-pushed
the
ct-pod-security-context
branch
from
fa91d19
to
5fa770f
Compare
|
Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla |
CatherineThompson
force-pushed
the
ct-pod-security-context
branch
from
5fa770f
to
cfc9018
Compare
|
Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla |
| runAsUser: {{ .runAsUser }} | ||
| runAsGroup: {{ .runAsGroup }} | ||
| {{- end }} | ||
| {{- toYaml .Values.securityContext | nindent 8 }} |
There was a problem hiding this comment.
According to #181, it might be a good idea to put the whole securityContext in a condition block, in case it's empty.
There was a problem hiding this comment.
If I add securityContext: ~ to a values file, the template renders as securityContext: null which then gets applied as securityContext: {}. It seems to handle that situation. If you think a condition block reads better, I'll add it in.
There was a problem hiding this comment.
So we don't need a condition block, thanks! Can you document that in the comment for this section?
There was a problem hiding this comment.
I tested this and it doesn't work with either ~, empty string or an empty object. Please put this in a conditional block.
There was a problem hiding this comment.
Hmm, I wonder why I wasn't able to reproduce the the issue. Yeah, I'll put in the conditional sometime today.
There was a problem hiding this comment.
@nineinchnick I've put the with condition back in and also added the ability to configure the security context for the jmx exporter container.
There was a problem hiding this comment.
Interesting, it's now possible to clear the securityContext with ~, but not with {}. Can you either document it, or change the with block into an if?
There was a problem hiding this comment.
Alright, I've updated the documentation.
CatherineThompson
force-pushed
the
ct-pod-security-context
branch
from
cfc9018
to
ee0ef51
Compare
CatherineThompson
force-pushed
the
ct-pod-security-context
branch
3 times, most recently
from
336535e
to
e6f04ea
Compare
CatherineThompson
force-pushed
the
ct-pod-security-context
branch
from
a88fec3
to
1e20e2c
Compare
CatherineThompson
force-pushed
the
ct-pod-security-context
branch
5 times, most recently
from
ff036b3
to
7ed479a
Compare
CatherineThompson
force-pushed
the
ct-pod-security-context
branch
from
7ed479a
to
ea1fa95
Compare
No description provided.