Skip to content

Commit aa4f056

Browse files
authored
[OCTRL-1091] Proper privileges for Pods in TaskTemplate CRDs (#837)
[control-operator] proper privileges added to task-templates manifests
1 parent 3bcfc6a commit aa4f056

3 files changed

Lines changed: 13 additions & 0 deletions

File tree

control-operator/ecs-manifests/task-templates/readout-tasktemplate.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,17 @@ spec:
1212
pod:
1313
hostNetwork: true
1414
hostIPC: true
15+
securityContext:
16+
fsGroup: 1100
17+
supplementalGroups: [10, 1105]
1518
containers:
1619
- name: readout
1720
image: gitlab-registry.cern.ch/aliceo2group/dockerfiles/alma9-flp-node/readout:1
1821
command: ["/opt/o2/bin/o2-readout-exe"]
1922
securityContext:
2023
privileged: true
24+
runAsUser: 1100
25+
runAsGroup: 1100
2126
volumeMounts:
2227
- name: host-shm
2328
mountPath: /dev/shm

control-operator/ecs-manifests/task-templates/stfbuilder-senderoutput-tasktemplate.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,16 @@ spec:
1515
hostNetwork: true
1616
hostIPC: true
1717
securityContext:
18+
fsGroup: 1100
19+
supplementalGroups: [10, 1105]
1820
containers:
1921
- name: stfbuilder
2022
image: gitlab-registry.cern.ch/aliceo2group/dockerfiles/alma9-flp-node/dd:1
2123
command: [/opt/o2/bin/StfBuilder]
2224
securityContext:
2325
privileged: true
26+
runAsUser: 1100
27+
runAsGroup: 1100
2428
volumeMounts:
2529
- name: host-shm
2630
mountPath: /dev/shm

control-operator/ecs-manifests/task-templates/stfsender-tasktemplate.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,16 @@ spec:
2222
hostNetwork: true
2323
hostIPC: true
2424
securityContext:
25+
fsGroup: 1100
26+
supplementalGroups: [10, 1105]
2527
containers:
2628
- name: stfsender
2729
image: gitlab-registry.cern.ch/aliceo2group/dockerfiles/alma9-flp-node/dd:1
2830
command: ["numactl"]
2931
securityContext:
3032
privileged: true
33+
runAsUser: 1100
34+
runAsGroup: 1100
3135
volumeMounts:
3236
- name: host-shm
3337
mountPath: /dev/shm

0 commit comments

Comments
 (0)