From 0aec9e139ebb7a5d7c601cea0419db4b7f07e718 Mon Sep 17 00:00:00 2001
From: Sanket Sudake <sanketsudake@gmail.com>
Date: Tue, 29 Nov 2022 10:44:30 +0530
Subject: [PATCH] Enable security context by default (#2644)

We enable security context by default now, so that the fission pod do not have root access to the system.

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
---
 charts/fission-all/values.yaml | 18 +++++++++---------
 skaffold.yaml                  |  7 -------
 2 files changed, 9 insertions(+), 16 deletions(-)

diff --git a/charts/fission-all/values.yaml b/charts/fission-all/values.yaml
index 8f3f49b8..f88a6ba4 100644
--- a/charts/fission-all/values.yaml
+++ b/charts/fission-all/values.yaml
@@ -166,7 +166,7 @@ executor:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -303,7 +303,7 @@ router:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -329,7 +329,7 @@ buildermgr:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -357,7 +357,7 @@ controller:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -394,7 +394,7 @@ webhook:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -421,7 +421,7 @@ kubewatcher:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -453,7 +453,7 @@ storagesvc:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -480,7 +480,7 @@ timer:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
@@ -725,7 +725,7 @@ canaryDeployment:
   ## This is an experimental section, please verify before enabling in production.
   ## Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1
   securityContext:
-    enabled: false
+    enabled: true
     ## Mark it false, if you want to stop the non root user validation
     runAsNonRoot: true
     fsGroup: 10001
diff --git a/skaffold.yaml b/skaffold.yaml
index 1db143a5..ef96a5bc 100644
--- a/skaffold.yaml
+++ b/skaffold.yaml
@@ -58,13 +58,6 @@ deploy:
         # Use /var/log directory for kind logs export
         terminationMessagePath: /var/log/termination-log
         terminationMessagePolicy: FallbackToLogsOnError
-        executor.securityContext.enabled: true
-        router.securityContext.enabled: true
-        buildermgr.securityContext.enabled: true
-        controller.securityContext.enabled: true
-        kubewatcher.securityContext.enabled: true
-        webhook.securityContext.enabled: true
-        storagesvc.securityContext.enabled: true
         controller.enabled: false
         serviceMonitor.enabled: false
         serviceMonitor.namespace: monitoring