Skip to content

feat!: Add (Pod)SecurityContextBuilder::with_stackable_defaults - #1205

Merged
sbernauer merged 16 commits into
mainfrom
chore/security-context-stackable-defaults
Aug 4, 2026
Merged

feat!: Add (Pod)SecurityContextBuilder::with_stackable_defaults#1205
sbernauer merged 16 commits into
mainfrom
chore/security-context-stackable-defaults

Conversation

@sbernauer

@sbernauersbernauer commented Apr 28, 2026•
edited
Loading

Copy link
Copy Markdown
Member

Description

Part of stackabletech/issues#645

Definition of Done Checklist

  • Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
  • Please make sure all these things are done and tick the boxes

Author

  • Changes are OpenShift compatible - To the best of my knowledge
  • CRD changes approved
  • CRD documentation for all fields, following the style guide.
  • Integration tests passed (for non trivial changes)
  • Changes need to be "offline" compatible

Reviewer

  • Code contains useful comments
  • Changelog updated

Acceptance

  • Feature Tracker has been updated
  • Proper release label has been added

Release notes (copy for operator changelogs)

### Changed- All product containers now run with `securityContext.runAsNonRoot` set to `true` to improve security.
### Fixed- Fix a longstanding problem of including empty `categories`, `shortNames` and `additionalPrinterColumns` in the CRDs,
which could cause problems with GitOps tools (e.g. ArgoCD) reporting a diff in the custom resources.
See [our internal issue](https://github.com/stackabletech/hdfs-operator/issues/626) and [the fix](https://github.com/kube-rs/kube/pull/2042) for details.

sbernauer
sbernauer commented Apr 28, 2026
View reviewed changes
Comment threadcrates/stackable-operator/src/builder/pod/security.rs Outdated
@siegfriedweber
siegfriedweber self-requested a review May 6, 2026 16:04
@siegfriedwebersiegfriedweber moved this to Development: In Review in Stackable EngineeringMay 6, 2026
siegfriedweber
siegfriedweber requested changes May 11, 2026
View reviewed changes
Comment threadcrates/stackable-operator/src/builder/pod/security.rs
Comment threadcrates/stackable-operator/src/builder/pod/security.rs
Comment threadcrates/stackable-operator/src/builder/pod/security.rs Outdated
@sbernauersbernauer self-assigned this Jun 17, 2026
siegfriedweber
siegfriedweber requested changes Jun 25, 2026
View reviewed changes
Comment threadcrates/stackable-operator/CHANGELOG.md Outdated
Comment threadcrates/stackable-operator/src/builder/pod/security.rs
@sbernauersbernauer changed the title feat!: Add PodSecurityContextBuilder::with_stackable_defaultsfeat!: Add (Pod)SecurityContextBuilder::with_stackable_defaultsJun 25, 2026
siegfriedweber
siegfriedweber requested changes Jun 25, 2026
View reviewed changes
Comment threadcrates/stackable-operator/src/builder/pod/security.rs Outdated
Comment threadcrates/stackable-operator/CHANGELOG.md Outdated
Comment threadcrates/stackable-operator/src/builder/pod/security.rs Outdated
Comment threadcrates/stackable-operator/src/builder/pod/security.rs
@sbernauer
sbernauer requested review from siegfriedweber and removed request for siegfriedweberAugust 3, 2026 12:19
@sbernauersbernauer moved this from Development: In Review to Development: Done in Stackable EngineeringAug 3, 2026
@sbernauersbernauer moved this from Development: Done to Development: In Review in Stackable EngineeringAug 3, 2026
siegfriedweber
siegfriedweber approved these changes Aug 3, 2026
View reviewed changes

@siegfriedwebersiegfriedweber left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sbernauersbernauer mentioned this pull request Aug 3, 2026
Merged
Saul-STFC pushed a commit to Saul-STFC/operator-templating that referenced this pull request Aug 4, 2026
@sbernauer
fix: Set correct user IDs for container images build by nix (stackabl…
fa9866b
…etech#619)
I noticed this while working on
stackabletech/operator-rs#1205, as the
bundle-builder was rejected by Kubernetes up as it wanted to run as root.
@sbernauer
sbernauer added this pull request to the merge queueAug 4, 2026
@sbernauersbernauer moved this from Development: In Review to Development: Done in Stackable EngineeringAug 4, 2026
Merged via the queue into main with commit 43fe29eAug 4, 2026
5 checks passed
@sbernauer
sbernauer deleted the chore/security-context-stackable-defaults branch August 4, 2026 11:20
@sbernauersbernauer mentioned this pull request Aug 4, 2026
Merged
@sbernauersbernauer added release-note Denotes a PR that will be considered when it comes time to generate release notes. release/26.11.0 scheduled-for/26.11.0 labels Aug 7, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@siegfriedwebersiegfriedwebersiegfriedweber approved these changes

Assignees

@sbernauersbernauer

Labels

release/26.11.0release-noteDenotes a PR that will be considered when it comes time to generate release notes.scheduled-for/26.11.0

Projects

Stackable Engineering
Status: Development: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sbernauer@siegfriedweber