Sprinkle fsGroupChangePolicy on like magic!

Signed-off-by: Martyn Ranyard <m@rtyn.berlin>
2025-06-20 09:30:26 +00:00 · 2025-06-20 09:30:26 +00:00 · 92b454a88a
commit 92b454a88a
parent 926a6047d5
3 changed files with 3 additions and 0 deletions
--- a/apps-helm/code-server/templates/deployment.yaml
+++ b/apps-helm/code-server/templates/deployment.yaml
@ -32,6 +32,7 @@ spec:
      {{- if .Values.securityContext.enabled }}
      securityContext:
        fsGroup: {{ .Values.securityContext.fsGroup }}
+        fsGroupChangePolicy: "OnRootMismatch" # There's a chmod already, and no other setup is using this volume!
      {{- end }}
      {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
      initContainers:
--- a/apps-helm/samba4/values.yaml
+++ b/apps-helm/samba4/values.yaml
@ -21,6 +21,7 @@ fullnameOverride: ""

 podSecurityContext:
  fsGroup: 1000
+  fsGroupChangePolicy: "OnRootMismatch"

 samba:
  global:
--- a/apps-kustomized/nextcloud/deploy.yaml
+++ b/apps-kustomized/nextcloud/deploy.yaml
@ -102,6 +102,7 @@ spec:
      schedulerName: default-scheduler
      securityContext:
        fsGroup: 33
+        fsGroupChangePolicy: OnRootMismatch
      terminationGracePeriodSeconds: 30
      volumes:
      - name: nextcloud-main