Set fsGroup by default, add initContainer when persistence is enabled.

ten7 · Feb 8, 2024 · 0d2dbb7 · 0d2dbb7
1 parent 2dd880d
commit 0d2dbb7
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 2 deletions.
diff --git a/charts/pantheon-backup/templates/cronjob.yaml b/charts/pantheon-backup/templates/cronjob.yaml
@@ -29,6 +29,18 @@ spec:
           serviceAccountName: {{ include "pantheon-backup.serviceAccountName" . }}
           securityContext:
             {{- toYaml .Values.podSecurityContext | nindent 12 }}
+          {{- if .Values.persistence.enabled }}
+          initContainers:
+            - name: fix-pvc-permissions
+              image: alpine
+              command:
+                - "sh"
+                - "-c"
+                - "chown -R 1000:1000 /backups"
+              volumeMounts:
+                - name: cache
+                  mountPath: /backups
+          {{- end }}
           containers:
           - name: {{ .Chart.Name }}
             securityContext:

diff --git a/charts/pantheon-backup/values.yaml b/charts/pantheon-backup/values.yaml
@@ -159,8 +159,8 @@ serviceAccount:
   # If not set and create is true, a name is generated using the fullname template
   name:
 
-podSecurityContext: {}
-  # fsGroup: 2000
+podSecurityContext:
+  fsGroup: 1000
 
 securityContext: {}
   # capabilities: