Run as user node

build/process-template.sh

@@ -23,6 +23,11 @@ export TRAVIS_COMMIT
 GIT_REMOTE="$(git remote get-url origin)"
 export GIT_REMOTE
 
+NODE_USER_ID="$(docker run -it node:lts-alpine /usr/bin/id -u node | tr -d '\r' | tr -d '\n')"
+export NODE_USER_ID
+NODE_GROUP_ID="$(docker run -it node:lts-alpine /usr/bin/id -g node | tr -d '\r' | tr -d '\n')"
+export NODE_GROUP_ID
+
 envsubst <"${THIS_DIR}/viewTemplate.json" >/tmp/view.json
 
 npx mustache /tmp/view.json "${FILE}"

build/viewTemplate.json

@@ -1,5 +1,7 @@
 {
   "TRAVIS_COMMIT": "${TRAVIS_COMMIT}",
   "TRAVIS_TAG": "${TRAVIS_TAG}",
-  "GIT_REMOTE": "${GIT_REMOTE}"
+  "GIT_REMOTE": "${GIT_REMOTE}",
+  "NODE_USER_ID": "${NODE_USER_ID}",
+  "NODE_GROUP_ID": "${NODE_GROUP_ID}"
 }

kubernetes/ManagedSet/resource.yaml

@@ -3,13 +3,19 @@ kind: List
 metadata:
   name: managedset-controller-list
   annotations:
-    version: "{{TRAVIS_COMMIT}}"
+    razee.io/git-repo: "{{{GIT_REMOTE}}}"
+    razee.io/commit-sha: "{{{TRAVIS_COMMIT}}}"
+    version: "{{{TRAVIS_COMMIT}}}"
 type: array
 items:
   - apiVersion: apps/v1
     kind: Deployment
     metadata:
       name: managedset-controller
+      annotations:
+        razee.io/git-repo: "{{{GIT_REMOTE}}}"
+        razee.io/commit-sha: "{{{TRAVIS_COMMIT}}}"
+        version: "{{{TRAVIS_COMMIT}}}"
       labels:
         razee/watch-resource: "lite"
     spec:
@@ -27,8 +33,12 @@ items:
           name: managedset-controller
         spec:
           serviceAccountName: razeedeploy-sa
+          securityContext:
+            runAsUser: {{{NODE_USER_ID}}}
+            runAsGroup: {{{NODE_GROUP_ID}}}
+            fsGroup: {{{NODE_GROUP_ID}}}
           containers:
-            - image: "quay.io/razee/managedset:{{TRAVIS_TAG}}"
+            - image: "quay.io/razee/managedset:{{{TRAVIS_TAG}}}"
               resources:
                 limits:
                   memory: 200Mi