Default podSecurityContext to run as 65534:65534

This is required for clusters with a runAsNonRoot policy for regular workload (eg. Lokomotive).
flatcar · Mar 9, 2021 · ba3ad0b · ba3ad0b
1 parent 7915948
commit ba3ad0b
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/charts/nebraska/README.md b/charts/nebraska/README.md
@@ -36,7 +36,7 @@ $ helm install my-nebraska nebraska/nebraska
 | `strategy.rollingUpdate.maxSurge`       | The maximum number of pods that can be scheduled above the desired number of pods (Only applies when `strategy.type` is `RollingUpdate`) | `nil`                                 |
 | `strategy.rollingUpdate.maxUnavailable` | The maximum number of pods that can be unavailable during the update (Only applies when `strategy.type` is `RollingUpdate`)              | `nil`                                 |
 | `podAnnotations`                        | Annotations for pods                                                                                                                     | `nil`                                 |
-| `podSecurityContext`                    | Holds pod-level security attributes and common container settings                                                                        | `nil`                                 |
+| `podSecurityContext`                    | Holds pod-level security attributes and common container settings                                                                        | Check `values.yaml` file              |
 | `securityContext`                       | Security options the container should run with                                                                                           | `nil`                                 |
 | `service.type`                          | Kubernetes Service type                                                                                                                  | `ClusterIP`                           |
 | `service.port`                          | Kubernetes Service port                                                                                                                  | `80`                                  |

diff --git a/charts/nebraska/values.yaml b/charts/nebraska/values.yaml
@@ -94,7 +94,9 @@ strategy:
 
 podAnnotations: {}
 
-podSecurityContext: {}
+podSecurityContext:
+  runAsUser: 65534
+  runAsGroup: 65534
   # fsGroup: 2000
 
 securityContext: {}