[FLINK-27595] Make security context configurable in helm

This closes #210.
apache · May 13, 2022 · af08660 · af08660
1 parent 73369b8
commit af08660
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 2 deletions.
diff --git a/helm/flink-kubernetes-operator/templates/flink-operator.yaml b/helm/flink-kubernetes-operator/templates/flink-operator.yaml
@@ -36,8 +36,7 @@ spec:
         kubectl.kubernetes.io/default-container: {{ .Chart.Name }}
     spec:
       securityContext:
-        runAsUser: 9999
-        runAsGroup: 9999
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -69,6 +68,8 @@ spec:
               value: {{ .Values.jvmArgs.operator }}
             - name: FLINK_OPERATOR_WATCH_NAMESPACES
               value: {{ join "," .Values.watchNamespaces  }}
+          securityContext:
+            {{- toYaml .Values.operatorSecurityContext | nindent 12 }}
           volumeMounts:
             - name: flink-operator-config-volume
               mountPath: /opt/flink/conf
@@ -108,6 +109,8 @@ spec:
               value: /opt/flink/plugins
             - name: OPERATOR_NAMESPACE
               value: {{ .Release.Namespace }}
+          securityContext:
+            {{- toYaml .Values.webhookSecurityContext | nindent 12 }}
           volumeMounts:
           - name: keystore
             mountPath: "/certs"

diff --git a/helm/flink-kubernetes-operator/values.yaml b/helm/flink-kubernetes-operator/values.yaml
@@ -58,6 +58,15 @@ operatorVolumes:
 #      persistentVolumeClaim:
 #        claimName: flink-artifacts
 
+podSecurityContext:
+  runAsUser: 9999
+  runAsGroup: 9999
+  # fsGroup: 9999
+
+operatorSecurityContext: {}
+
+webhookSecurityContext: {}
+
 webhook:
   create: true
   keystore: