Merge pull request #2422 from philipgough/ci-fix

ci: Add runAsGroup for blackbox exporter containers
2024-05-13 11:33:53 +02:00
parent 2a07e4579e d1ec0ab362
commit 2147ea0079
2 changed files with 4 additions and 0 deletions
--- a/jsonnet/kube-prometheus/components/blackbox-exporter.libsonnet
+++ b/jsonnet/kube-prometheus/components/blackbox-exporter.libsonnet
@@ -183,6 +183,7 @@ function(params) {
      } else {
        runAsNonRoot: true,
        runAsUser: 65534,
+        runAsGroup: 65534,
        allowPrivilegeEscalation: false,
        readOnlyRootFilesystem: true,
        capabilities: { drop: ['ALL'] },
@@ -205,6 +206,7 @@ function(params) {
      securityContext: {
        runAsNonRoot: true,
        runAsUser: 65534,
+        runAsGroup: 65534,
        allowPrivilegeEscalation: false,
        readOnlyRootFilesystem: true,
        capabilities: { drop: ['ALL'] },
--- a/manifests/blackboxExporter-deployment.yaml
+++ b/manifests/blackboxExporter-deployment.yaml
@@ -48,6 +48,7 @@ spec:
            drop:
            - ALL
          readOnlyRootFilesystem: true
+          runAsGroup: 65534
          runAsNonRoot: true
          runAsUser: 65534
        volumeMounts:
@@ -72,6 +73,7 @@ spec:
            drop:
            - ALL
          readOnlyRootFilesystem: true
+          runAsGroup: 65534
          runAsNonRoot: true
          runAsUser: 65534
        terminationMessagePath: /dev/termination-log