Merge pull request #1301 from splunk/CSPL_2532_fsGrChPo

CSPL_2532 - fsGroupChangePolicy change
splunk · Mar 6, 2024 · 350229e · 350229e
2 parents 2e623e6 + b86dfb0
commit 350229e
Show file tree

Hide file tree

Showing 12 changed files with 94 additions and 90 deletions.
diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
@@ -33,6 +33,7 @@ spec:
         runAsUser: 1001
         fsGroup: 1001
         runAsNonRoot: true
+        fsGroupChangePolicy: "OnRootMismatch"
       hostNetwork: false
       hostPID: false
       hostIPC: false

diff --git a/helm-chart/splunk-operator/values.yaml b/helm-chart/splunk-operator/values.yaml
@@ -77,6 +77,7 @@ splunkOperator:
     runAsUser: 1001
     fsGroup: 1001
     runAsNonRoot: true
+    fsGroupChangePolicy: "OnRootMismatch"
 
   # Set usage of host networking and namespace
   # reference: https://kubernetes.io/docs/concepts/security/pod-security-policy/#host-namespaces

diff --git a/pkg/splunk/common/urls_testingcode.go b/pkg/splunk/common/urls_testingcode.go
diff --git a/pkg/splunk/enterprise/clustermanager_test.go b/pkg/splunk/enterprise/clustermanager_test.go
diff --git a/pkg/splunk/enterprise/clustermaster_test.go b/pkg/splunk/enterprise/clustermaster_test.go
diff --git a/pkg/splunk/enterprise/configuration.go b/pkg/splunk/enterprise/configuration.go
@@ -24,7 +24,7 @@ import (
 	"reflect"
 	"strconv"
 
-	"github.com/wk8/go-ordered-map/v2"
+	orderedmap "github.com/wk8/go-ordered-map/v2"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
@@ -833,10 +833,12 @@ func updateSplunkPodTemplateWithConfig(ctx context.Context, client splcommon.Con
 	runAsUser := int64(41812)
 	fsGroup := int64(41812)
 	runAsNonRoot := true
+	fsGroupChangePolicy := corev1.FSGroupChangeOnRootMismatch
 	podTemplateSpec.Spec.SecurityContext = &corev1.PodSecurityContext{
-		RunAsUser:    &runAsUser,
-		FSGroup:      &fsGroup,
-		RunAsNonRoot: &runAsNonRoot,
+		RunAsUser:           &runAsUser,
+		FSGroup:             &fsGroup,
+		RunAsNonRoot:        &runAsNonRoot,
+		FSGroupChangePolicy: &fsGroupChangePolicy,
 	}
 
 	livenessProbe := getLivenessProbe(ctx, cr, instanceType, spec)

diff --git a/pkg/splunk/enterprise/indexercluster_test.go b/pkg/splunk/enterprise/indexercluster_test.go
diff --git a/pkg/splunk/enterprise/licensemanager_test.go b/pkg/splunk/enterprise/licensemanager_test.go
diff --git a/pkg/splunk/enterprise/licensemaster_test.go b/pkg/splunk/enterprise/licensemaster_test.go
diff --git a/pkg/splunk/enterprise/monitoringconsole_test.go b/pkg/splunk/enterprise/monitoringconsole_test.go
diff --git a/pkg/splunk/enterprise/searchheadcluster_test.go b/pkg/splunk/enterprise/searchheadcluster_test.go
diff --git a/pkg/splunk/enterprise/standalone_test.go b/pkg/splunk/enterprise/standalone_test.go