How to implement podSecurityContext to unset Helm Chart values for deployment in OpenShift?

[carlmes]

I'm doing a manual deployment in Red Hat OpenShift following the Open-Metadata kubernetes deployment guide. Everything deploys successfully, however the Deployments fail to start with a warning about security, since OpenShift handles non-root users a little differently to Kubernetes.

I can manually fix the error by editing the Deplyment yaml, and changing the values to null, for example:

          securityContext:
            runAsUser: 50000 > manually change this to null
            runAsGroup: 0 > manually change this to null

However I would like to fix this when deploying with helm, using the --values values-deps.yaml argument. However I haven't been successful trying to implement the PodSecurityContext described in Helm Values.

Could I get an example of what this would look like in both Open-Metadata dependencies chart, as well as Open-Metadata chart?

Here's what I've tried thus far with partial success:

1. Was able to remove the security context from MySQL in the dependencies chart by adding:

mysql:
  primary:
    containerSecurityContext:
      enabled: false
    podSecurityContext:
      enabled: false

2. Was able to partially remove the security context from Airflow by adding, however there is still a stray fsGroup value that is not affected by this:

airflow:
  airflow:
      uid: ""
      gid: ""

However these mods appear to be "hacks", I'm hoping for some sort of global PodSecurityContext override that I could add to my chart values when deploying?

[harshach]

@akash-jain-10 can you help here

[carlmes]

A little more context, here's where we're trying to update the Airflow components in the Open-Metadata dependencies Helm chart:

# Airflow configurations for helm dependency
# you can find more details about this here https://github.com/airflow-helm/charts
airflow:
  enabled: true
  airflow:
    image:
      repository: docker.getcollate.io/openmetadata/ingestion
      tag: 1.2.2
      pullPolicy: "IfNotPresent"
      uid: ""
      gid: ""
    defaultSecurityContext:
      fsGroup: 9999

In this example, setting uid and gid to "" seems to unset one of the securityContext areas in the deployed YAML, however we still and up with another area containing fsGroup. If I give it a number (like 9999 in the example above) I can see it being applied however the deployment fails because of security constraints. If I give it a value like null or "" the deployment fails, null is ignored and "" causes type conversion failures.