fix(shard): decouple fsGroup from pool runtime identity#542
Open
Verolop wants to merge 4 commits into
Open
Conversation
- Separate process UID/GID configuration from pod-level filesystem group semantics. - Preserve image-provided runtime identity unless operators explicitly configure one. Signed-off-by: Verónica López <veronica.lopez@supabase.io>
- Validate shared-PGDATA UID requirements only after templates and overrides are resolved. - Keep partial PoolSpec objects composable while rejecting invalid final pool configuration. Signed-off-by: Verónica López <veronica.lopez@supabase.io>
- Align generated pod security contexts with Kubernetes fsGroup semantics. - Prevent fsGroup from overriding the runtime identity declared by images or explicit config. Signed-off-by: Verónica López <veronica.lopez@supabase.io>
This comment has been minimized.
This comment has been minimized.
🔬 Go Test Coverage ReportSummary
Status✅ PASS DetailShow New Coverage |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
this PR fixes pool pod security context handling so
fsGroupis treated as pod-level filesystem group access, not as the container process UID/GID. It preserves image-provided runtime identity by default and adds explicit UID/GID configuration for cases that need it.Main Changes:
runAsUserandrunAsGroupfields to container config.runAsUser/runAsGroupfromfsGroup.fsGroupscoped toPodSecurityContext.fsGroup.Testing:
Tests cover the behaviour at each layer where the bug could regress: API/schema generation, template and override resolution, admission-time resolved validation, and final pod rendering. Unit tests verify that
fsGroupno longer changes container UID/GID, explicit identities are preserved, custom images can retain image identity, and runtime identity changes affect pod hashes. Resolver tests cover inheritance and partial override behaviour, including valid and invalid final shared-PGDATA identities. CEL/envtest coverage verifies that CRD schema validation accepts partial identity shapes while leaving final compatibility checks to resolved validation.