Run cinder-backup and volume as cinder user

These services do not need to run as the root user, run them as the cinder user instead.
openstack-k8s-operators · Nov 25, 2024 · f6aa4d5 · f6aa4d5
1 parent 5c82e9d
commit f6aa4d5
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 4 deletions.
diff --git a/pkg/cinderbackup/statefulset.go b/pkg/cinderbackup/statefulset.go
@@ -39,7 +39,6 @@ func StatefulSet(
 	annotations map[string]string,
 ) *appsv1.StatefulSet {
 	trueVar := true
-	rootUser := int64(0)
 	cinderUser := int64(cinderv1.CinderUserID)
 	cinderGroup := int64(cinderv1.CinderGroupID)
 
@@ -126,7 +125,7 @@ func StatefulSet(
 							Args:  args,
 							Image: instance.Spec.ContainerImage,
 							SecurityContext: &corev1.SecurityContext{
-								RunAsUser:  &rootUser,
+								RunAsUser:  &cinderUser,
 								Privileged: &trueVar,
 							},
 							Env:           env.MergeEnvs([]corev1.EnvVar{}, envVars),

diff --git a/pkg/cindervolume/statefulset.go b/pkg/cindervolume/statefulset.go
@@ -40,7 +40,6 @@ func StatefulSet(
 	usesLVM bool,
 ) *appsv1.StatefulSet {
 	trueVar := true
-	rootUser := int64(0)
 	cinderUser := int64(cinderv1.CinderUserID)
 	cinderGroup := int64(cinderv1.CinderGroupID)
 
@@ -133,7 +132,7 @@ func StatefulSet(
 							Args:  args,
 							Image: instance.Spec.ContainerImage,
 							SecurityContext: &corev1.SecurityContext{
-								RunAsUser:  &rootUser,
+								RunAsUser:  &cinderUser,
 								Privileged: &trueVar,
 							},
 							Env:           env.MergeEnvs([]corev1.EnvVar{}, envVars),