From f199923a3c2b28e5d6c55becd2d1cadb6ff911c7 Mon Sep 17 00:00:00 2001
From: Richard Case <198425+richardcase@users.noreply.github.com>
Date: Wed, 1 Apr 2020 16:57:30 +0100
Subject: [PATCH] feat: started to add a flag to disable security context

---
 charts/flagger/templates/deployment.yaml | 5 +++--
 charts/flagger/values.yaml               | 8 ++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/charts/flagger/templates/deployment.yaml b/charts/flagger/templates/deployment.yaml
index 2c2115ea..f4934857 100644
--- a/charts/flagger/templates/deployment.yaml
+++ b/charts/flagger/templates/deployment.yaml
@@ -50,9 +50,10 @@ spec:
         {{- end }}
       containers:
         - name: flagger
+          {{- if .Values.securityContext.enabled }}
           securityContext:
-            readOnlyRootFilesystem: true
-            runAsUser: 10001
+{{ toYaml .Values.securityContext.context | indent 12 }}
+          {{- end }}
           volumeMounts:
             {{- if .Values.istio.kubeconfig.secretName }}
             - name: kubeconfig
diff --git a/charts/flagger/values.yaml b/charts/flagger/values.yaml
index e2a2bb11..c6fcf5e2 100644
--- a/charts/flagger/values.yaml
+++ b/charts/flagger/values.yaml
@@ -30,6 +30,14 @@ selectorLabels: ""
 configTracking:
   enabled: true
 
+# when enabled, it will add a security context for the flagger pod. You may
+# need to disable this if you are running flagger on OpenShift
+securityContext:
+  enabled: true
+  context:
+    readOnlyRootFilesystem: true
+    runAsUser: 10001
+
 # when specified, flagger will publish events to the provided webhook
 eventWebhook: ""