Skip to content

Conversation

@Pidu2
Copy link

@Pidu2 Pidu2 commented Nov 27, 2025

This PR addresses the requirements of #673.

In an OpenShift environment, you usually do not want to set runAsUser or runAsGroup to something specific, instead it is chosen automatically by the cluster to a random value. Also, any other SecurityContext Values of the Pods will automatically be set to secure defaults (allowPrivilegeEscalation: false etc.).

It is therefore usually best to just not set it at all.

With this change, containerSecurityContext.enabled and podSecurityContext.enabled can be set to false to stop rendering out these fields completely.

In #673 it was proposed to just remove the required setting for runAsUser or runAsGroup. If this is considered preferred to my solution, I can adjust the PR accordingly.

@dosubot dosubot bot added the size:M This PR changes 30-99 lines, ignoring generated files. label Nov 27, 2025
@Reamer
Copy link

Reamer commented Dec 1, 2025

I don't think this is a good solution for #673.
We should change the schema so that null values are allowed for runAs* and not remove the entire security settings.

Most settings are the default under Openshift. However, readOnlyRootFilesystem: true is not, which is omitted with this change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:M This PR changes 30-99 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants