search

1Password / connect-helm-charts

Official 1Password Helm Charts
https://developer.1password.com
MIT License
93 stars 74 forks source link

Update securityContext to use volume permission and ownership change policy #26

Closed thatguygriff closed 2 years ago

thatguygriff commented 3 years ago

Currently we use an initContainer to correct the permissions on volume mounts to be accessible by reduced privilege user accounts. Starting with Kubernetes 1.20+ there is a beta feature to configure volume permissions and perform ownership changes.

We should update the chart to support this feature and replace the initContainer flow with it.

jpcoenen commented 3 years ago

Yes, using fsGroup would be much more cleaner!

I think we do not even need the experimental fsGroupChangePolicy feature. If I understand it correclty, it's only needed if you mount a volume that already contains data that is owned by another group and need it to be chown'ed. In our case, we have an empty volume, so I guess setting fsGroup only would do the trick.

thatguygriff commented 3 years ago

Unfortunately both fsGroup andfsGroupChangePolicy` are 1.20+ only. I almost included them in a previous PR but tested on a 1.19 cluster and caught myself

jpcoenen commented 2 years ago

The initContainer has been removed in #80. So closing this issue.