GetPodSecurityContext return the proper PodSecurityContext set in the cluster for Pods
(cluster *apiv1.Cluster)
| 446 | |
| 447 | // GetPodSecurityContext return the proper PodSecurityContext set in the cluster for Pods |
| 448 | func GetPodSecurityContext(cluster *apiv1.Cluster) *corev1.PodSecurityContext { |
| 449 | // Under Openshift we inherit SecurityContext from the restricted security context constraint |
| 450 | if utils.HaveSecurityContextConstraints() { |
| 451 | return nil |
| 452 | } |
| 453 | |
| 454 | uid := cluster.GetPostgresUID() |
| 455 | gid := cluster.GetPostgresGID() |
| 456 | defaultContext := &corev1.PodSecurityContext{ |
| 457 | SeccompProfile: cluster.GetSeccompProfile(), |
| 458 | RunAsUser: &uid, |
| 459 | RunAsGroup: &gid, |
| 460 | RunAsNonRoot: ptr.To(true), |
| 461 | FSGroup: &gid, |
| 462 | } |
| 463 | |
| 464 | if cluster.Spec.PodSecurityContext == nil { |
| 465 | return defaultContext |
| 466 | } |
| 467 | |
| 468 | // Create a copy to avoid mutating the cluster object |
| 469 | definedContext := cluster.Spec.PodSecurityContext.DeepCopy() |
| 470 | |
| 471 | if definedContext.RunAsUser == nil { |
| 472 | definedContext.RunAsUser = defaultContext.RunAsUser |
| 473 | } |
| 474 | if definedContext.RunAsGroup == nil { |
| 475 | definedContext.RunAsGroup = defaultContext.RunAsGroup |
| 476 | } |
| 477 | if definedContext.SeccompProfile == nil { |
| 478 | definedContext.SeccompProfile = defaultContext.SeccompProfile |
| 479 | } |
| 480 | |
| 481 | return definedContext |
| 482 | } |
| 483 | |
| 484 | // NewInstance creates a new instance Pod with the plugin patches applied |
| 485 | func NewInstance( |
no test coverage detected