From 895ef9b7d095ddaace220c2f8230cccf45346eef Mon Sep 17 00:00:00 2001
From: Alexander Awitin <alexanderawitin@gmail.com>
Date: Tue, 12 Feb 2019 15:48:47 +0800
Subject: [PATCH] [stable/postgresql] Fix "Can't initialize iptables table
 'nat': Permission denied (you must be root)" error when installed on an
 Istio-enabled cluster. (#11226)

Only define the `securityContext` on the main container instead of defining it on the top level `spec` which results into injected containers by Istio inheriting this definition (i.e. istio-init).

Related topic: https://github.com/istio/old_issues_repo/issues/316

Signed-off-by: Alexander Awitin <alexanderawitin@gmail.com>
---
 stable/postgresql/Chart.yaml                        |  2 +-
 stable/postgresql/templates/statefulset-slaves.yaml | 10 +++++-----
 stable/postgresql/templates/statefulset.yaml        | 10 +++++-----
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/stable/postgresql/Chart.yaml b/stable/postgresql/Chart.yaml
index 6bb649cb3b..7675f70b33 100644
--- a/stable/postgresql/Chart.yaml
+++ b/stable/postgresql/Chart.yaml
@@ -1,5 +1,5 @@
 name: postgresql
-version: 3.10.1
+version: 3.10.2
 appVersion: 10.6.0
 description: Chart for PostgreSQL, an object-relational database management system (ORDBMS) with an emphasis on extensibility and on standards-compliance.
 keywords:
diff --git a/stable/postgresql/templates/statefulset-slaves.yaml b/stable/postgresql/templates/statefulset-slaves.yaml
index b3eb95aeda..464e5f9bac 100644
--- a/stable/postgresql/templates/statefulset-slaves.yaml
+++ b/stable/postgresql/templates/statefulset-slaves.yaml
@@ -26,11 +26,6 @@ spec:
         heritage: {{ .Release.Service | quote }}
         role: slave
     spec:
-      {{- if .Values.securityContext.enabled }}
-      securityContext:
-        fsGroup: {{ .Values.securityContext.fsGroup }}
-        runAsUser: {{ .Values.securityContext.runAsUser }}
-      {{- end }}
       {{- if .Values.image.pullSecrets }}
       imagePullSecrets:
       {{- range .Values.image.pullSecrets }}
@@ -79,6 +74,11 @@ spec:
         imagePullPolicy: "{{ .Values.image.pullPolicy }}"
         resources:
 {{ toYaml .Values.resources | indent 10 }}
+        {{- if .Values.securityContext.enabled }}
+        securityContext:
+          fsGroup: {{ .Values.securityContext.fsGroup }}
+          runAsUser: {{ .Values.securityContext.runAsUser }}
+        {{- end }}
         env:
         {{- if .Values.image.debug}}
         - name: BASH_DEBUG
diff --git a/stable/postgresql/templates/statefulset.yaml b/stable/postgresql/templates/statefulset.yaml
index 80d9c28551..1bd7d1e856 100644
--- a/stable/postgresql/templates/statefulset.yaml
+++ b/stable/postgresql/templates/statefulset.yaml
@@ -27,11 +27,6 @@ spec:
         heritage: {{ .Release.Service | quote }}
         role: master
     spec:
-      {{- if .Values.securityContext.enabled }}
-      securityContext:
-        fsGroup: {{ .Values.securityContext.fsGroup }}
-        runAsUser: {{ .Values.securityContext.runAsUser }}
-      {{- end }}
       {{- if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }}
       imagePullSecrets:
       {{- range .Values.image.pullSecrets }}
@@ -83,6 +78,11 @@ spec:
         imagePullPolicy: "{{ .Values.image.pullPolicy }}"
         resources:
 {{ toYaml .Values.resources | indent 10 }}
+        {{- if .Values.securityContext.enabled }}
+        securityContext:
+          fsGroup: {{ .Values.securityContext.fsGroup }}
+          runAsUser: {{ .Values.securityContext.runAsUser }}
+        {{- end }}
         env:
         {{- if .Values.image.debug}}
         - name: BASH_DEBUG