SecurityContext should support runAsUser

I have an issue with my PodSecurityPolicy specifying runAsNonRoot as true.

The JuiceBalancer already uses the non-root user app but Kubernetes needs a numeric id in order to verify that it is not the root user:

Error: container has runAsNonRoot and image has non-numeric user (app), cannot verify user is non-root

For this to work, the pod securityContext needs to specify runAsUser with the according user id of app.

I would love a change to either:

1. include the numeric id of the app user in the template:

-- helm/multi-juicer/templates/juice-balancer-deployment.yaml

securityContext:
  runAsUser: 100
  runAsGroup: 101

1. or include a template variable for the pod securityContext, so that users can modify it themselves:

-- helm/multi-juicer/templates/juice-balancer-deployment.yaml

{{- if .Values.balancer.securityContext }}
securityContext:
  {{ toYaml .Values.balancer.securityContext | indent 8 }}
{{- end }}

-- helm/multi-juicer/values.yaml

balancer:
  securityContext: {}

[DerGut]

@J12934 Thanks!

It was all working as expected for us. Thanks for the very quick release 🙏

[DerGut]

I completely agree with you, the second option seems more appropriate either way. I can submit a PR for that 👍

There should be a way to specify a numeric user without using the securityContext 🤔 . Looking at cert-manager, they did exactly that. However, they used bazel for specifying the docker image instead of using a Dockerfile. I’ll try to understand how this works and report back!