Skip to content

Commit d5ba63f

Browse files
committed
chart/redpanda: Set securityContext.runAsNonRoot to false for tuning container
(cherry picked from commit f187f32) # Conflicts: # charts/redpanda/chart/templates/_statefulset.go.tpl # operator/internal/lifecycle/testdata/cases.pools.golden.txtar
1 parent 1632585 commit d5ba63f

File tree

6 files changed

+3341
-3
lines changed

6 files changed

+3341
-3
lines changed
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
project: charts/redpanda
2+
kind: Fixed
3+
body: |
4+
Fix `CreateContainerConfigError: Error: container's runAsUser breaks non-root policy...` error with `statefulset.podTemplate.spec.securityContext.runAsNonRoot: true`
5+
time: 2025-11-03T20:51:45.198677+02:00

charts/redpanda/chart/templates/_statefulset.go.tpl

Lines changed: 642 additions & 0 deletions
Large diffs are not rendered by default.

charts/redpanda/statefulset.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -395,9 +395,10 @@ func statefulSetInitContainerTuning(dot *helmette.Dot) *corev1.Container {
395395
Capabilities: &corev1.Capabilities{
396396
Add: []corev1.Capability{`SYS_RESOURCE`},
397397
},
398-
Privileged: ptr.To(true),
399-
RunAsUser: ptr.To(int64(0)),
400-
RunAsGroup: ptr.To(int64(0)),
398+
Privileged: ptr.To(true),
399+
RunAsNonRoot: ptr.To(false),
400+
RunAsUser: ptr.To(int64(0)),
401+
RunAsGroup: ptr.To(int64(0)),
401402
},
402403
VolumeMounts: append(append(CommonMounts(dot),
403404
templateToVolumeMounts(dot, values.Statefulset.InitContainers.Tuning.ExtraVolumeMounts)...),

0 commit comments

Comments
 (0)