- 
          
- 
                Notifications
    You must be signed in to change notification settings 
- Fork 6
Change default user id and gid #916
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
3a002ee    to
    344631c      
    Compare
  
    8f359e6    to
    062ee3f      
    Compare
  
    062ee3f    to
    9c0ba33      
    Compare
  
    bf5a6a4    to
    826434c      
    Compare
  
    | Release NotesThe default user id and group id used by all our docker images was 1000. This has now been changed to high random numbers (782252253 / 574654813 respectively). Additionally our operators also hardcoded these values. This also changed which means that the user ids and group ids will change as of this release. This is for security purposes to reduce the chance of overlaps with existing ids on the host. | 
| This was reverted in #1115 and needs to be reapplied once Step 2 from the issue to not hardcode uid & gid in operators is finished. | 
Description
Part of stackabletech/issues#645
Change default user id and gid to the same ones we use in the operators themselves.
These are only the defaults that are used when a Pod does not specify their own
securityContext.runAsUserorrunAsGroup.As of now all our operators do set these (and
fsGroup) to 1000 and 0 respectively.As the next step we want to remove that hardcoding so the default would then fall back to what we specify here.
Therefore I do believe that this PR should be a simple change with no downstream consequences until the PRs from stackabletech/issues#651 are merged.
Definition of Done Checklist
TIP: Running integration tests with a new product image
The image can be built and uploaded to the kind cluster with the following commands:
See the output of
baketo retrieve the image tag for<image-tagged-with-the-major-version>.