From e8d9fbe30967fadda67466532a026aab55c27d57 Mon Sep 17 00:00:00 2001
From: Alexander Awitin <alexanderawitin@gmail.com>
Date: Wed, 13 Feb 2019 20:08:39 +0800
Subject: [PATCH] [stable/mongodb] Fix "Can't initialize iptables table 'nat':
 Permission denied (you must be root)" error when installed on an
 Istio-enabled cluster. (#11367)

Only define the `securityContext.runAsUser` on the main container instead of defining it on the top level `spec` which results into injected containers by Istio inheriting this definition (i.e. istio-init).

Related topic: https://github.com/istio/old_issues_repo/issues/316, https://github.com/helm/charts/pull/10682#issuecomment-455511703, https://github.com/helm/charts/pull/11226#issuecomment-462175101

Signed-off-by: Alexander Awitin <alexanderawitin@gmail.com>
---
 stable/mongodb/Chart.yaml                              | 2 +-
 stable/mongodb/templates/deployment-standalone.yaml    | 6 +++++-
 stable/mongodb/templates/statefulset-arbiter-rs.yaml   | 6 +++++-
 stable/mongodb/templates/statefulset-primary-rs.yaml   | 6 +++++-
 stable/mongodb/templates/statefulset-secondary-rs.yaml | 6 +++++-
 5 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/stable/mongodb/Chart.yaml b/stable/mongodb/Chart.yaml
index 760f5ec1d4..7c4959385f 100644
--- a/stable/mongodb/Chart.yaml
+++ b/stable/mongodb/Chart.yaml
@@ -1,5 +1,5 @@
 name: mongodb
-version: 5.3.3
+version: 5.3.4
 appVersion: 4.0.6
 description: NoSQL document-oriented database that stores JSON-like documents with dynamic schemas, simplifying the integration of data in content-driven applications.
 keywords:
diff --git a/stable/mongodb/templates/deployment-standalone.yaml b/stable/mongodb/templates/deployment-standalone.yaml
index df4e412067..e221f11717 100644
--- a/stable/mongodb/templates/deployment-standalone.yaml
+++ b/stable/mongodb/templates/deployment-standalone.yaml
@@ -38,7 +38,6 @@ spec:
       {{- if .Values.securityContext.enabled }}
       securityContext:
         fsGroup: {{ .Values.securityContext.fsGroup }}
-        runAsUser: {{ .Values.securityContext.runAsUser }}
       {{- end }}
       {{- if .Values.affinity }}
       affinity:
@@ -62,6 +61,11 @@ spec:
       - name: {{ template "mongodb.fullname" . }}
         image: {{ template "mongodb.image" . }}
         imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
+        {{- if .Values.securityContext.enabled }}
+        securityContext:
+          runAsNonRoot: true
+          runAsUser: {{ .Values.securityContext.runAsUser }}
+        {{- end }}
         env:
         {{- if .Values.image.debug}}
         - name: NAMI_DEBUG
diff --git a/stable/mongodb/templates/statefulset-arbiter-rs.yaml b/stable/mongodb/templates/statefulset-arbiter-rs.yaml
index ac4cc5f47a..ac388d06f3 100644
--- a/stable/mongodb/templates/statefulset-arbiter-rs.yaml
+++ b/stable/mongodb/templates/statefulset-arbiter-rs.yaml
@@ -37,7 +37,6 @@ spec:
       {{- if .Values.securityContext.enabled }}
       securityContext:
         fsGroup: {{ .Values.securityContext.fsGroup }}
-        runAsUser: {{ .Values.securityContext.runAsUser }}
       {{- end }}
       {{- if .Values.affinity }}
       affinity:
@@ -61,6 +60,11 @@ spec:
         - name: {{ template "mongodb.name" . }}-arbiter
           image: {{ template "mongodb.image" . }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{- if .Values.securityContext.enabled }}
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: {{ .Values.securityContext.runAsUser }}
+          {{- end }}
           ports:
           - containerPort: {{ .Values.service.port }}
             name: mongodb
diff --git a/stable/mongodb/templates/statefulset-primary-rs.yaml b/stable/mongodb/templates/statefulset-primary-rs.yaml
index c24774c18f..ad74455868 100644
--- a/stable/mongodb/templates/statefulset-primary-rs.yaml
+++ b/stable/mongodb/templates/statefulset-primary-rs.yaml
@@ -42,7 +42,6 @@ spec:
       {{- if .Values.securityContext.enabled }}
       securityContext:
         fsGroup: {{ .Values.securityContext.fsGroup }}
-        runAsUser: {{ .Values.securityContext.runAsUser }}
       {{- end }}
       {{- if .Values.affinity }}
       affinity:
@@ -66,6 +65,11 @@ spec:
         - name: {{ template "mongodb.name" . }}-primary
           image: {{ template "mongodb.image" . }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{- if .Values.securityContext.enabled }}
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: {{ .Values.securityContext.runAsUser }}
+          {{- end }}
           ports:
           - containerPort: {{ .Values.service.port }}
             name: mongodb
diff --git a/stable/mongodb/templates/statefulset-secondary-rs.yaml b/stable/mongodb/templates/statefulset-secondary-rs.yaml
index 1220c4c540..69910ab330 100644
--- a/stable/mongodb/templates/statefulset-secondary-rs.yaml
+++ b/stable/mongodb/templates/statefulset-secondary-rs.yaml
@@ -43,7 +43,6 @@ spec:
       {{- if .Values.securityContext.enabled }}
       securityContext:
         fsGroup: {{ .Values.securityContext.fsGroup }}
-        runAsUser: {{ .Values.securityContext.runAsUser }}
       {{- end }}
       {{- if .Values.affinity }}
       affinity:
@@ -67,6 +66,11 @@ spec:
         - name: {{ template "mongodb.name" . }}-secondary
           image: {{ template "mongodb.image" . }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{- if .Values.securityContext.enabled }}
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: {{ .Values.securityContext.runAsUser }}
+          {{- end }}
           ports:
           - containerPort: {{ .Values.service.port }}
             name: mongodb