Merge "Security: Add Pod user to missed services"

barbican/templates/deployment-api.yaml

@@ -46,6 +46,8 @@ spec:
           image: {{ .Values.images.api }}
           imagePullPolicy: {{ .Values.images.pull_policy }}
 {{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
+          securityContext:
+            runAsUser: {{ .Values.pod.user.barbican.uid }}
           command:
             - /tmp/barbican.sh
             - start

barbican/values.yaml

@@ -29,6 +29,9 @@ images:
   pull_policy: "IfNotPresent"
 
 pod:
+  user:
+    barbican:
+      uid: 1000
   affinity:
       anti:
         type:

mistral/templates/deployment-api.yaml

@@ -47,6 +47,8 @@ spec:
           image: {{ .Values.images.api }}
           imagePullPolicy: {{ .Values.images.pull_policy }}
 {{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
+          securityContext:
+            runAsUser: {{ .Values.pod.user.mistral.uid }}
           command:
             - /tmp/mistral-api.sh
             - start

mistral/templates/deployment-executor.yaml

@@ -46,6 +46,8 @@ spec:
           image: {{ .Values.images.executor }}
           imagePullPolicy: {{ .Values.images.pull_policy }}
 {{ tuple $envAll $envAll.Values.pod.resources.executor | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
+          securityContext:
+            runAsUser: {{ .Values.pod.user.mistral.uid }}
           command:
             - /tmp/mistral-executor.sh
           volumeMounts:

mistral/templates/statefulset-engine.yaml

@@ -41,6 +41,8 @@ spec:
           image: {{ .Values.images.engine }}
           imagePullPolicy: {{ .Values.images.pull_policy }}
 {{ tuple $envAll $envAll.Values.pod.resources.engine | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
+          securityContext:
+            runAsUser: {{ .Values.pod.user.mistral.uid }}
           command:
             - /tmp/mistral-engine.sh
           volumeMounts:

mistral/templates/statefulset-event-engine.yaml

@@ -43,6 +43,8 @@ spec:
           image: {{ .Values.images.event_engine }}
           imagePullPolicy: {{ .Values.images.pull_policy }}
 {{ tuple $envAll $envAll.Values.pod.resources.event_engine | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
+          securityContext:
+            runAsUser: {{ .Values.pod.user.mistral.uid }}
           command:
             - /tmp/mistral-event-engine.sh
           volumeMounts: