commit d0fa8cf57eaac53f723c0ca8399f58b55655ea6f
author Bruno Sakoto <bruno.sakoto@bell.ca> Wed Sep 15 18:30:20 2021 -0400
committer Bruno Sakoto <bruno.sakoto@bell.ca> Thu Sep 30 22:57:24 2021 -0400
tree cda6deb2e774ae1f65b7b667b8456ae3d27e3dd4
parent a001a61bdd6430027b39281f9d79366e837c7494

[COMMON] Run timescale with postgres user

Timescale container is ran with postgres user and group which are
defined with uid 70 and gid 70.

Data volume owner is changed for postgres.

See also:
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

Issue-ID: CPS-667
Signed-off-by: Bruno Sakoto <bruno.sakoto@bell.ca>
Change-Id: Ia87922ba68bb47a7a07aaf61f368143d970278b6

kubernetes/common/timescaledb/templates/statefulset.yaml

diff --git a/kubernetes/common/timescaledb/templates/statefulset.yaml b/kubernetes/common/timescaledb/templates/statefulset.yaml
index 9b63de4..435c925 100644
--- a/kubernetes/common/timescaledb/templates/statefulset.yaml
+++ b/kubernetes/common/timescaledb/templates/statefulset.yaml
@@ -31,6 +31,18 @@
       serviceAccountName: {{ include "common.fullname" (dict "suffix" "read" "dot" . ) }}
       securityContext:
       {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      initContainers:
+        - name: chowm-mount-path
+          command:
+            - /bin/sh
+          args:
+            - -c
+            - chown -R {{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.runAsGroup }} /var/lib/postgresql/data
+          image: {{ include "repositoryGenerator.image.busybox" . }}
+          imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+          volumeMounts:
+            - mountPath: /var/lib/postgresql/data
+              name: {{ include "common.fullname" . }}
       containers:
         - name: {{ include "common.name" . }}
           image: {{ include "repositoryGenerator.dockerHubRepository" . }}/{{ .Values.image }}