diff --git a/charts/redis-ha/Chart.yaml b/charts/redis-ha/Chart.yaml index d92cdcb..51e5eef 100644 --- a/charts/redis-ha/Chart.yaml +++ b/charts/redis-ha/Chart.yaml @@ -5,7 +5,7 @@ keywords: - redis - keyvalue - database -version: 4.35.10 +version: 4.35.11 appVersion: 8.2.4 description: This Helm chart provides a highly available Redis implementation with a master/slave configuration and uses Sentinel sidecars for failover management icon: https://img.icons8.com/external-tal-revivo-shadow-tal-revivo/24/external-redis-an-in-memory-data-structure-project-implementing-a-distributed-logo-shadow-tal-revivo.png diff --git a/charts/redis-ha/templates/redis-ha-statefulset.yaml b/charts/redis-ha/templates/redis-ha-statefulset.yaml index eeb54c2..c8c318b 100644 --- a/charts/redis-ha/templates/redis-ha-statefulset.yaml +++ b/charts/redis-ha/templates/redis-ha-statefulset.yaml @@ -129,11 +129,19 @@ spec: {{- if and .Values.hostPath.path .Values.hostPath.chown }} - name: hostpath-chown image: {{ .Values.image.repository }}:{{ .Values.image.tag }} - securityContext: {{- include "compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 10 }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + # hostPath ownership changes require root privileges. + securityContext: + runAsUser: 0 + runAsGroup: 0 + runAsNonRoot: false + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault resources: {{ toYaml .Values.init.resources | nindent 10 }} command: - chown - - "{{ .Values.containerSecurityContext.runAsUser }}" + - "{{ .Values.containerSecurityContext.runAsUser }}:{{ default .Values.containerSecurityContext.runAsUser .Values.securityContext.fsGroup }}" - /data volumeMounts: - name: data