only change buildkit fsGroup during mismatch or initial pod startup (#59

)
dominodatalab · Sep 2, 2022 · 74295c5 · 74295c5
1 parent 7d05659
commit 74295c5
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/deployments/helm/hephaestus/templates/buildkit/statefulset.yaml b/deployments/helm/hephaestus/templates/buildkit/statefulset.yaml
@@ -32,8 +32,9 @@ spec:
     spec:
       {{- include "hephaestus.imagePullSecrets" . | nindent 6 }}
       serviceAccountName: {{ include "hephaestus.buildkit.fullname" . }}
-      {{- if .Values.buildkit.rootless }}
       securityContext:
+        fsGroupChangePolicy: "OnRootMismatch"
+      {{- if .Values.buildkit.rootless }}
         fsGroup: 1000
       {{- end }}
       containers: