Add runAsGroup in SecurityContext (#101) (#21173)

Signed-off-by: devOpsHelm <devops+1@hazelcast.com>

stable/hazelcast/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: hazelcast
-version: 3.0.3
+version: 3.0.4
 appVersion: "4.0"
 tillerVersion: ">=2.7.2"
 kubeVersion: ">=1.9.0-0"

stable/hazelcast/README.adoc

@@ -195,6 +195,9 @@ Management Center |`+true+`
 |`+securityContext.runAsUser+` |User ID used to run the Hazelcast and Management
 Center containers |`+65534+`
 
+| `securityContext.runAsGroup` |Primary Group ID used to run all processes in the
+ Hazelcast Jet and Hazelcast Jet Management Center containers | `+65534+`
+
 |`+securityContext.fsGroup+` |Group ID associated with the Hazelcast and
 Management Center container |`+65534+`
 
@@ -395,4 +398,4 @@ rest-api:
       enabled: true
     CLUSTER_WRITE:
       enabled: true
-----
+----

stable/hazelcast/templates/mancenter-statefulset.yaml

@@ -41,6 +41,7 @@ spec:
       securityContext:
         runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }}
         runAsUser: {{ .Values.securityContext.runAsUser }}
+        runAsGroup: {{ .Values.securityContext.runAsGroup }}
         fsGroup: {{ .Values.securityContext.fsGroup }}
       {{- if .Values.mancenter.affinity }}
       affinity:
@@ -106,6 +107,7 @@ spec:
         securityContext:
           runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }}
           runAsUser: {{ .Values.securityContext.runAsUser }}
+          runAsGroup: {{ .Values.securityContext.runAsGroup }}
           privileged: false
           readOnlyRootFilesystem: false
           allowPrivilegeEscalation: false

stable/hazelcast/templates/statefulset.yaml

@@ -43,6 +43,7 @@ spec:
       securityContext:
         runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }}
         runAsUser: {{ .Values.securityContext.runAsUser }}
+        runAsGroup: {{ .Values.securityContext.runAsGroup }}
         fsGroup: {{ .Values.securityContext.fsGroup }}
       {{- if .Values.affinity }}
       affinity:
@@ -114,6 +115,7 @@ spec:
         securityContext:
           runAsNonRoot: {{ if eq (int .Values.securityContext.runAsUser) 0 }}false{{ else }}true{{ end }}
           runAsUser: {{ .Values.securityContext.runAsUser }}
+          runAsGroup: {{ .Values.securityContext.runAsGroup }}
           privileged: false
           readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFilesystem }}
           allowPrivilegeEscalation: false

stable/hazelcast/templates/tests/test-hazelcast.yaml

@@ -19,6 +19,7 @@ spec:
   securityContext:
     runAsNonRoot: true
     runAsUser: 1001
+    runAsGroup: 1001
   {{- if .Values.nodeSelector }}
   nodeSelector:
 {{ toYaml .Values.nodeSelector | indent 4 }}
@@ -38,6 +39,7 @@ spec:
     securityContext:
       runAsNonRoot: true
       runAsUser: 1001
+      runAsGroup: 1001
       privileged: false
       readOnlyRootFilesystem: true
       allowPrivilegeEscalation: false

stable/hazelcast/templates/tests/test-management-center.yaml

@@ -19,6 +19,7 @@ spec:
   securityContext:
     runAsNonRoot: true
     runAsUser: 1001
+    runAsGroup: 1001
   {{- if .Values.nodeSelector }}
   nodeSelector:
 {{ toYaml .Values.nodeSelector | indent 4 }}
@@ -38,6 +39,7 @@ spec:
     securityContext:
       runAsNonRoot: true
       runAsUser: 1001
+      runAsGroup: 1001
       privileged: false
       readOnlyRootFilesystem: true
       allowPrivilegeEscalation: false

stable/hazelcast/values.yaml

@@ -168,6 +168,8 @@ securityContext:
   enabled: true
   # runAsUser is the user ID used to run the container
   runAsUser: 65534
+  # runAsGroup is the primary group ID used to run all processes within any container of the pod
+  runAsGroup: 65534
   # fsGroup is the group ID associated with the container
   fsGroup: 65534
   # readOnlyRootFilesystem is a flag to enable readOnlyRootFilesystem for the Hazelcast security context