-
-
Notifications
You must be signed in to change notification settings - Fork 7
Change default user id and gid #916
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
3a002ee
to
344631c
Compare
8f359e6
to
062ee3f
Compare
062ee3f
to
9c0ba33
Compare
bf5a6a4
to
826434c
Compare
Release NotesThe default user id and group id used by all our docker images was 1000. This has now been changed to high random numbers (782252253 / 574654813 respectively). Additionally our operators also hardcoded these values. This also changed which means that the user ids and group ids will change as of this release. This is for security purposes to reduce the chance of overlaps with existing ids on the host. |
This was reverted in #1115 and needs to be reapplied once Step 2 from the issue to not hardcode uid & gid in operators is finished. |
Description
Part of stackabletech/issues#645
Change default user id and gid to the same ones we use in the operators themselves.
These are only the defaults that are used when a Pod does not specify their own
securityContext.runAsUser
orrunAsGroup
.As of now all our operators do set these (and
fsGroup
) to 1000 and 0 respectively.As the next step we want to remove that hardcoding so the default would then fall back to what we specify here.
Therefore I do believe that this PR should be a simple change with no downstream consequences until the PRs from stackabletech/issues#651 are merged.
Definition of Done Checklist
TIP: Running integration tests with a new product image
The image can be built and uploaded to the kind cluster with the following commands:
See the output of
bake
to retrieve the image tag for<image-tagged-with-the-major-version>
.