reset security context for store

Signed-off-by: Thibault Mange <[email protected]>
rhobs · Oct 16, 2023 · c501736 · c501736
1 parent 30e48b4
commit c501736
Show file tree

Hide file tree

Showing 7 changed files with 7 additions and 18 deletions.
diff --git a/resources/services/app-sre-stage-01/rhobs/observatorium-metrics-store-default-template.yaml b/resources/services/app-sre-stage-01/rhobs/observatorium-metrics-store-default-template.yaml
@@ -363,9 +363,7 @@ objects:
             name: hashmod-config
         nodeSelector:
           kubernetes.io/os: linux
-        securityContext:
-          fsGroup: 65534
-          runAsUser: 65534
+        securityContext: {}
         serviceAccountName: observatorium-thanos-store-default
         terminationGracePeriodSeconds: 120
         volumes:

diff --git a/resources/services/app-sre-stage-01/rhobs/observatorium-metrics-store-rhel-template.yaml b/resources/services/app-sre-stage-01/rhobs/observatorium-metrics-store-rhel-template.yaml
@@ -363,9 +363,7 @@ objects:
             name: hashmod-config
         nodeSelector:
           kubernetes.io/os: linux
-        securityContext:
-          fsGroup: 65534
-          runAsUser: 65534
+        securityContext: {}
         serviceAccountName: observatorium-thanos-store-rhel
         terminationGracePeriodSeconds: 120
         volumes:

diff --git a/...urces/services/app-sre-stage-01/rhobs/observatorium-metrics-store-telemeter-template.yaml b/...urces/services/app-sre-stage-01/rhobs/observatorium-metrics-store-telemeter-template.yaml
@@ -363,9 +363,7 @@ objects:
             name: hashmod-config
         nodeSelector:
           kubernetes.io/os: linux
-        securityContext:
-          fsGroup: 65534
-          runAsUser: 65534
+        securityContext: {}
         serviceAccountName: observatorium-thanos-store-telemeter
         terminationGracePeriodSeconds: 120
         volumes:

diff --git a/resources/services/telemeter-prod-01/rhobs/observatorium-metrics-store-default-template.yaml b/resources/services/telemeter-prod-01/rhobs/observatorium-metrics-store-default-template.yaml
@@ -363,9 +363,7 @@ objects:
             name: hashmod-config
         nodeSelector:
           kubernetes.io/os: linux
-        securityContext:
-          fsGroup: 65534
-          runAsUser: 65534
+        securityContext: {}
         serviceAccountName: observatorium-thanos-store-default
         terminationGracePeriodSeconds: 120
         volumes:

diff --git a/resources/services/telemeter-prod-01/rhobs/observatorium-metrics-store-rhel-template.yaml b/resources/services/telemeter-prod-01/rhobs/observatorium-metrics-store-rhel-template.yaml
@@ -363,9 +363,7 @@ objects:
             name: hashmod-config
         nodeSelector:
           kubernetes.io/os: linux
-        securityContext:
-          fsGroup: 65534
-          runAsUser: 65534
+        securityContext: {}
         serviceAccountName: observatorium-thanos-store-rhel
         terminationGracePeriodSeconds: 120
         volumes:

diff --git a/...rces/services/telemeter-prod-01/rhobs/observatorium-metrics-store-telemeter-template.yaml b/...rces/services/telemeter-prod-01/rhobs/observatorium-metrics-store-telemeter-template.yaml
@@ -363,9 +363,7 @@ objects:
             name: hashmod-config
         nodeSelector:
           kubernetes.io/os: linux
-        securityContext:
-          fsGroup: 65534
-          runAsUser: 65534
+        securityContext: {}
         serviceAccountName: observatorium-thanos-store-telemeter
         terminationGracePeriodSeconds: 120
         volumes:

diff --git a/services_go/observatorium/metrics.go b/services_go/observatorium/metrics.go
@@ -170,6 +170,7 @@ func makeStore(namespace, imageTag string, cfg ThanosTenantConfig[store.StoreSta
 	storeStatefulSet.Image = thanosImage
 	storeStatefulSet.ImageTag = imageTag
 	storeStatefulSet.Namespace = namespace
+	storeStatefulSet.SecurityContext = corev1.PodSecurityContext{}
 	storeStatefulSet.Affinity.PodAntiAffinity.PreferredDuringSchedulingIgnoredDuringExecution[0].PodAffinityTerm.Namespaces = []string{}
 	storeStatefulSet.Replicas = 1
 	delete(storeStatefulSet.PodResources.Limits, corev1.ResourceCPU)