[BGD-4448] run DP components as as non root

spotinst · Jan 17, 2024 · dc8bbfa · dc8bbfa
1 parent d99dd81
commit dc8bbfa
Show file tree

Hide file tree

Showing 7 changed files with 13 additions and 4 deletions.
diff --git a/charts/bigdata-operator/values.yaml b/charts/bigdata-operator/values.yaml
@@ -35,7 +35,8 @@ podLabels:
 podSecurityContext: {}
 # fsGroup: 2000
 
-securityContext: {}
+securityContext:
+  runAsNonRoot: true
 # capabilities:
 #   drop:
 #   - ALL

diff --git a/charts/bigdata-proxy/values.yaml b/charts/bigdata-proxy/values.yaml
@@ -45,7 +45,8 @@ podLabels:
 podSecurityContext: {}
   # fsGroup: 2000
 
-securityContext: {}
+securityContext:
+  runAsNonRoot: true
   # capabilities:
   #   drop:
   #   - ALL

diff --git a/charts/bigdata-spark-watcher/values.yaml b/charts/bigdata-spark-watcher/values.yaml
@@ -56,7 +56,8 @@ podLabels:
 podSecurityContext: {}
   # fsGroup: 2000
 
-securityContext: {}
+securityContext:
+  runAsNonRoot: true
   # capabilities:
   #   drop:
   #   - ALL

diff --git a/charts/bigdata-telemetry/Chart.yaml b/charts/bigdata-telemetry/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: bigdata-telemetry
 description: A Helm chart for the Spot Big Data Telemetry components
 type: application
-version: 0.2.0
+version: 0.2.1
 appVersion: "1.16.0"
 home: https://github.com/spotinst/charts
 icon: https://docs.spot.io/_media/images/spot_mark.png

diff --git a/charts/bigdata-telemetry/templates/thanos-receiver-statefulset.yaml b/charts/bigdata-telemetry/templates/thanos-receiver-statefulset.yaml
@@ -90,6 +90,8 @@ spec:
               port: 10902
               scheme: HTTP
             periodSeconds: 5
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
           terminationMessagePolicy: FallbackToLogsOnError
           volumeMounts:
             - mountPath: /var/thanos/receive

diff --git a/charts/bigdata-telemetry/values.yaml b/charts/bigdata-telemetry/values.yaml
@@ -15,6 +15,8 @@ thanos:
 
 nodeSelector: {}
 
+securityContext: {}
+
 affinity:
   nodeAffinity:
     requiredDuringSchedulingIgnoredDuringExecution:

diff --git a/charts/spark-operator/values.yaml b/charts/spark-operator/values.yaml
@@ -20,6 +20,8 @@ spark-operator:  # This section controls the behavior of the spark operator sub-
 
   disableExecutorReporting: false
 
+  securityContext: {}
+
   webhook:
     enable: true
     # If hostNetwork is set to true it is probably a good idea to change this (e.g. 25554)