Merge pull request #28 from ibakshay/main

Fix: Add SecurityContext to StatefulSet when Persistence is Enabled
perses · Oct 23, 2024 · 8765ba5 · 8765ba5
2 parents 0f8b747 + 890b126
commit 8765ba5
Show file tree

Hide file tree

Showing 4 changed files with 22 additions and 6 deletions.
diff --git a/charts/perses/templates/pvc.yaml b/charts/perses/templates/pvc.yaml
@@ -11,7 +11,9 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 spec:
+{{- if .Values.persistence.storageClass }}
   storageClassName: {{ .Values.persistence.storageClass }}
+{{- end }}
   accessModes:
   {{- range .Values.persistence.accessModes }}
     - {{ . | quote }}

diff --git a/charts/perses/templates/statefulset.yaml b/charts/perses/templates/statefulset.yaml
@@ -26,6 +26,8 @@ spec:
         {{- end }}
     spec:
       serviceAccountName: {{ include "perses.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.persistence.securityContext | nindent 8 }}
       containers:
       - name: {{ .Chart.Name }}
         image: "{{ .Values.image.name }}:{{ .Values.image.version | default .Chart.AppVersion }}"
@@ -98,4 +100,4 @@ spec:
         - name: datasources
           configMap:
             name: {{ include "perses.fullname" . }}-datasources
-        {{- end }}
+        {{- end }}
diff --git a/charts/perses/values.schema.json b/charts/perses/values.schema.json
@@ -411,6 +411,15 @@
         "size": {
           "type": "string"
         },
+        "securityContext":{
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "fsGroup": {
+              "type": "integer"
+            }
+          }
+        },
         "labels": {
           "type": "object"
         },
@@ -421,8 +430,7 @@
       "required": [
         "accessModes",
         "enabled",
-        "size",
-        "storageClass"
+        "size"
       ]
     },
     "livenessProbe": {

diff --git a/charts/perses/values.yaml b/charts/perses/values.yaml
@@ -149,8 +149,8 @@ persistence:
   # -- If disabled, it will use a emptydir volume
   enabled: false
 
-  # -- Specify the `storageClass` used to provision the volume
-  storageClass: ""
+  # -- Specify the `storageClass` to provision the volume for the PVC. If you don't specify a `storageClass`, a default `storageClass` will be used.
+  # storageClass: ""
 
   # -- PVC Access Modes for data volume
   accessModes:
@@ -159,6 +159,10 @@ persistence:
   # -- PVC Storage Request for data volume
   size: 8Gi
 
+  # -- Security context for the PVC when persistence is enabled
+  securityContext:
+    fsGroup: 2000
+
   # -- Labels for the PVC
   labels: {}
   # -- Annotations for the PVC
@@ -202,4 +206,4 @@ datasources:
   #     plugin:
   #       kind: PrometheusDatasource
   #       spec:
-  #         directUrl: https://prometheus.demo.do.prometheus.io
+  #         directUrl: https://prometheus.demo.do.prometheus.io