add postgres_security_context_settings

[rchaud]

Adding the option to add custom security context for Postgres as in K8s it does not start due to a permission issue. This allows to change the user id, group id, etc to anything other than 26 used by the image https://quay.io/repository/sclorg/postgresql-13-c9s

#138

Example usage:

postgres_security_context_settings:
    runAsUser: 1001
    fsGroup: 1001

[rooftopcellist]

@chinochao Thanks for the PR!

Ultimately, we intend to nest parameters like these under database. We want to do this nested approach with all of the operators eventually, but for the awx-operator for example, it will require us to create a new apiVersion to do so.

With eda-server-operator, we have the luxury of a fresh start and can do this now. Would you be open to re-working the PR?

The user could then define it on the EDA spec like this:

spec:
  database:
    security_context:
      runAsUser: 1001
      fsGroup: 1001

We'll also need CRD and CSV entries, like these, but nested under database:

• https://github.com/ansible/awx-operator/blob/7b02b5df04ba7221ea09666d06120f9dc02893c1/config/crd/bases/awx.ansible.com_awxs.yaml#L1887
• https://github.com/ansible/awx-operator/blob/7b02b5df04ba7221ea09666d06120f9dc02893c1/config/manifests/bases/awx-operator.clusterserviceversion.yaml#L113

[rooftopcellist]

@chinochao I was trying to reproduce the actual bug first while testing this out but could not while using k3s locally. Could you share more details about your deployment? It'd be good to know under what circumstances this permissions error might occur, so that we can document the fix better.

[maratsal]

you can reproduce this with deployment on EKS with gp2 storage class (based on aws-ebs)

kubectl get storageclass
NAME            PROVISIONER             RECLAIMPOLICY   VOLUMEBINDINGMODE      ALLOWVOLUMEEXPANSION   AGE
gp2 (default)   kubernetes.io/aws-ebs   Delete          WaitForFirstConsumer   false                  390d

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud