[Bug] Cannot run temporal services as non-root user in kubernetes

[fivos]

What are you really trying to do?

I'm trying to deploy the Temporal helm chart on Kubernetes, with an existing MySQL DB as the only dependency (i.e not using Cassandra or Elasticsearch). I have a requirement to run all services on Kubernetes as a non-root user.

Describe the bug

The issue described is the same as temporalio/temporal#1263 and mentioned in this forum thread. The original issue was closed with #221, which introduced the following:

securityContext:
  fsGroup: 1000 #temporal group
  runAsUser: 1000 #temporal user

However, the if statement preceding the securityContext block, requires either Cassandra or Elasticsearch to be enabled. Since I'm not using either, securityContext is not added to my deployment.

Minimal Reproduction

Install helm chart with

helm install -f values/values.mysql.yaml temporaltest \
  --set elasticsearch.enabled=false \
  --set server.config.persistence.default.sql.user=mysql_user \
  --set server.config.persistence.default.sql.password=mysql_password \
  --set server.config.persistence.visibility.sql.user=mysql_user \
  --set server.config.persistence.visibility.sql.password=mysql_password \
  --set server.config.persistence.default.sql.host=mysql_host \
  --set server.config.persistence.visibility.sql.host=mysql_host . --timeout 900s

Environment/Versions

• OS and processor: Linux
• Temporal Version: 1.17.1
• Are you using Docker or Kubernetes or building Temporal from source?: Kubernetes

[robholland]

Fixed in #494