Skip to content

fix(helm): don't pin runAsUser/runAsGroup in grafana-mcp and querydoc chart defaults #2134

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SarthakB11 wants to merge 1 commit into
base: main
Choose a base branch
from
+20 −12
Open

fix(helm): don't pin runAsUser/runAsGroup in grafana-mcp and querydoc chart defaults #2134

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions helm/tools/grafana-mcp/tests/deployment_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,12 +64,10 @@ tests:
- equal:
path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
value: true
- equal:
- isNull:
path: spec.template.spec.containers[0].securityContext.runAsUser
value: 1000
- equal:
- isNull:
path: spec.template.spec.containers[0].securityContext.runAsGroup
value: 999
- isNull:
path: spec.template.spec.containers[0].securityContext.seccompProfile

Expand Down
10 changes: 8 additions & 2 deletions helm/tools/grafana-mcp/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,8 +31,14 @@ securityContext:
drop:
- ALL
readOnlyRootFilesystem: true
runAsUser: 1000
runAsGroup: 999
# runAsUser / runAsGroup are left unset so the chart installs on OpenShift,
# where the restricted-v2 SCC assigns a per-namespace UID range and rejects a
# pinned UID outside it. runAsNonRoot (in podSecurityContext) enforces
# non-root: with runAsUser unset the container runs as the image's USER, so
# the mcp/grafana image must ship a non-root USER or the pod will fail to
# start. Set a fixed UID below on clusters that allow it:
# runAsUser: 1000
# runAsGroup: 999
Comment on lines +34 to +41

tolerations: []

Expand Down
6 changes: 2 additions & 4 deletions helm/tools/querydoc/tests/deployment_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,12 +112,10 @@ tests:
- equal:
path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
value: true
- equal:
- isNull:
path: spec.template.spec.containers[0].securityContext.runAsUser
value: 14000
- equal:
- isNull:
path: spec.template.spec.containers[0].securityContext.runAsGroup
value: 14000
- isNull:
path: spec.template.spec.containers[0].securityContext.seccompProfile

Expand Down
10 changes: 8 additions & 2 deletions helm/tools/querydoc/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,14 @@ securityContext:
drop:
- ALL
readOnlyRootFilesystem: true
runAsUser: 14000
runAsGroup: 14000
# runAsUser / runAsGroup are left unset so the chart installs on OpenShift,
# where the restricted-v2 SCC assigns a per-namespace UID range and rejects a
# pinned UID outside it. runAsNonRoot (in podSecurityContext) enforces
# non-root: with runAsUser unset the container runs as the image's USER, so
# the mcp/querydoc image must ship a non-root USER or the pod will fail to
# start. Set a fixed UID below on clusters that allow it:
# runAsUser: 14000
# runAsGroup: 14000
Comment on lines +28 to +35

tolerations: []

Expand Down
Loading