From da92351bafc56659d387a4cd925293e6675f3539 Mon Sep 17 00:00:00 2001 From: luantranminh Date: Wed, 20 May 2026 14:06:46 +0700 Subject: [PATCH] devdb: narrow YSQL devdb security override and set writable HOME --- internal/controller/devdb.go | 4 +++- test/e2e/e2e_test.go | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/internal/controller/devdb.go b/internal/controller/devdb.go index bd79f849..ad1ffd25 100644 --- a/internal/controller/devdb.go +++ b/internal/controller/devdb.go @@ -280,7 +280,9 @@ func AutomaticDevDBSpec(drv dbv1alpha1.Driver, schemaBound bool) (*corev1.PodSpe } // Containers c.Image = "yugabytedb/yugabyte:latest" - c.SecurityContext = nil + c.Env = []corev1.EnvVar{{Name: "HOME", Value: "/tmp"}} + c.SecurityContext.RunAsNonRoot = ptr.To(false) + c.SecurityContext.RunAsUser = ptr.To[int64](0) c.Command = []string{"bin/yugabyted", "start", "--background=false"} c.Ports = []corev1.ContainerPort{ {Name: drv.String(), ContainerPort: 5433}, diff --git a/test/e2e/e2e_test.go b/test/e2e/e2e_test.go index 3b5815df..07cf9c32 100644 --- a/test/e2e/e2e_test.go +++ b/test/e2e/e2e_test.go @@ -158,6 +158,7 @@ func TestOperator(t *testing.T) { ts.Check(ts.Exec("kubectl", "-n", ns, "apply", "-f", manifestPath)) ts.Check(ts.Exec("kubectl", "-n", ns, "wait", "--for=condition=available", "--timeout=2h", "deployment/"+cfg.name)) ts.Check(ts.Exec("kubectl", "-n", ns, "wait", "--for=condition=ready", "--timeout=2h", "pod", "-l", "app="+cfg.name)) + ts.Check(ts.Exec("kubectl", "-n", ns, "wait", "--for=jsonpath={.subsets[0].addresses[0].ip}", "--timeout=2h", "endpoints/"+cfg.name)) ts.Setenv(envVar, cfg.dsn(ns)) }, // atlas runs the atlas binary in the controller-manager pod.