File tree Expand file tree Collapse file tree 2 files changed +7
-3
lines changed
operator/src/main/java/oracle/kubernetes/operator/helpers Expand file tree Collapse file tree 2 files changed +7
-3
lines changed Original file line number Diff line number Diff line change @@ -156,7 +156,7 @@ protected V1Container createInitContainerForAuxiliaryImage(DeploymentImage auxil
156156 .command (Collections .singletonList (AUXILIARY_IMAGE_INIT_CONTAINER_WRAPPER_SCRIPT ))
157157 .env (createEnv (auxiliaryImage , getName (index )))
158158 .resources (createResources ())
159- .securityContext (getInitContainerSecurityContext ())
159+ .securityContext (PodSecurityHelper . getDefaultContainerSecurityContext ())
160160 .volumeMounts (Arrays .asList (
161161 new V1VolumeMount ().name (AUXILIARY_IMAGE_INTERNAL_VOLUME_NAME )
162162 .mountPath (AUXILIARY_IMAGE_TARGET_PATH ),
Original file line number Diff line number Diff line change @@ -592,13 +592,17 @@ protected V1PodSpec createPodSpec() {
592592 podSpec .securityContext (podSecurityContext .fsGroup (podSecurityContext .getRunAsGroup ()));
593593 } else if (podSecurityContext .getFsGroup () == null ) {
594594 Optional .ofNullable (TuningParameters .getInstance ()).ifPresent (instance -> {
595- if (!"OpenShift" .equalsIgnoreCase (instance .getKubernetesPlatform ())) {
595+ if (!"OpenShift" .equalsIgnoreCase (instance .getKubernetesPlatform ()) && ! isInitDomainOnPVRunAsRoot () ) {
596596 podSpec .securityContext (podSecurityContext .fsGroup (0L ));
597597 }
598598 });
599599 }
600600 if (podSpec .getSecurityContext ().getFsGroupChangePolicy () == null ) {
601- podSpec .getSecurityContext ().fsGroupChangePolicy ("OnRootMismatch" );
601+ Optional .ofNullable (TuningParameters .getInstance ()).ifPresent (instance -> {
602+ if (!"OpenShift" .equalsIgnoreCase (instance .getKubernetesPlatform ()) && !isInitDomainOnPVRunAsRoot ()) {
603+ podSpec .getSecurityContext ().fsGroupChangePolicy ("OnRootMismatch" );
604+ }
605+ });
602606 }
603607 }
604608 }
You can’t perform that action at this time.
0 commit comments