[test] set fsgroup

stuggi · Dec 12, 2023 · 7462109 · 7462109
1 parent 76a5944
commit 7462109
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/pkg/placement/deployment.go b/pkg/placement/deployment.go
@@ -139,6 +139,11 @@ func Deployment(
 				Spec: corev1.PodSpec{
 					ServiceAccountName: instance.RbacResourceName(),
 					Volumes:            volumes,
+					SecurityContext: &corev1.PodSecurityContext{
+						// since we run as PlacementUserID, e.g. certs need to be
+						// readable by the placement user, instead of root
+						FSGroup: ptr.To(PlacementUserID),
+					},
 					Containers: []corev1.Container{
 						{
 							Name: ServiceName + "-api",