From 3f4210e818d6e5b136a6eb7fb6ff66eb4029a7ed Mon Sep 17 00:00:00 2001 From: Fred Amaral Date: Fri, 31 Jul 2026 19:32:13 -0300 Subject: [PATCH] fix(streaming-hub): the values header still claimed fsGroup replaces the pod security context MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #1769 changed that block from replace to merge, and the comment inside _deployment.tpl was updated with it. This header in values.yaml was not — it still told operators that enabling rolesAnywhere discards streamingHub.podSecurityContext. That is the file people read before turning the feature on, so the stale half is the one that misleads. Now describes what the template actually does: fsGroup is merged in and wins, every other pod-level setting survives, and the old wholesale-replace behaviour is named as past so anyone who remembers it knows it changed. Verified by render, not by reading: with rolesAnywhere on and a custom podSecurityContext, the pod gets fsGroup 65532 alongside runAsNonRoot, seccompProfile and supplementalGroups. helm lint clean. This commit also unblocks the release, and that is deliberate rather than incidental. The Helm Release workflow triggers on push paths, and README.md is in paths-ignore — so #1799, which restored the chart's README section and is what makes the release script succeed, could not itself trigger a release. There is no workflow_dispatch, and re-running the old failed run would check out the tree without the section. A change inside charts/streaming-hub/ is the only trigger available, and this was the one real inconsistency left in it. Claude-Session: https://claude.ai/code/session_01AQHofhVKKGUbSo959SEn5r --- charts/streaming-hub/values.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/charts/streaming-hub/values.yaml b/charts/streaming-hub/values.yaml index f099e85c7..4fa0b1347 100644 --- a/charts/streaming-hub/values.yaml +++ b/charts/streaming-hub/values.yaml @@ -445,8 +445,10 @@ streamingHub: # kubernetes.io/tls (keys tls.crt / tls.key) named by certificateSecretName — # in the Lerian environments a cert-manager Certificate in the deploying overlay # creates it. fsGroup 65532 is applied to the pod so the sidecar's non-root user -# can read the 0440 projection; that REPLACES streamingHub.podSecurityContext -# while rolesAnywhere is enabled. +# can read the 0440 projection; it is MERGED into streamingHub.podSecurityContext +# while rolesAnywhere is enabled — fsGroup wins, and every other pod-level setting +# you configured (runAsNonRoot, seccompProfile, supplementalGroups, ...) survives. +# It used to replace the block wholesale, silently dropping all of them. # # trustAnchorArn / profileArn / roleArn are `required` when enabled — the chart # fails to render rather than starting a sidecar that cannot authenticate.