zalando / zalando/postgres-operator
New feature: set RunAsNonRoot on securityContext of Postgres statfullset
Open
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.2k
- Forks
- 1.1k
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 3
Description
Why:
On namespaces with security policy, Postgres cannot be deployed as the security context cannot be customized on the CRD.
Postgres CRD allow only to setup a custom user with spiloRunAsUser, this PR will set RunAsNonRoot to true when spiloRunAsUser is set.
Example of security policies that block the deployment of Postgres:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Postgres StatefulSet securityContext handling and references to the spiloRunAsUser CRD field. Check how the operator generates the StatefulSet when that field is set, then verify the resulting security context satisfies the cited run-as-non-root policies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes, postgresql
- Domain
- databases, infrastructure
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100