From 44a1b5476b06ea3d9ee7269809a1c0b2f00f15e6 Mon Sep 17 00:00:00 2001
From: Stavros Kois <47820033+stavros-k@users.noreply.github.com>
Date: Sun, 3 Oct 2021 12:01:19 +0300
Subject: [PATCH] run Deepstack as root (#1084)

---
 charts/stable/deepstack-cpu/SCALE/questions.yaml | 8 ++++----
 charts/stable/deepstack-cpu/values.yaml          | 8 ++++++++
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/charts/stable/deepstack-cpu/SCALE/questions.yaml b/charts/stable/deepstack-cpu/SCALE/questions.yaml
index 6a72c776876..734ad1c7958 100644
--- a/charts/stable/deepstack-cpu/SCALE/questions.yaml
+++ b/charts/stable/deepstack-cpu/SCALE/questions.yaml
@@ -621,7 +621,7 @@ questions:
           label: "ReadOnly Root Filesystem"
           schema:
             type: boolean
-            default: true
+            default: false
         - variable: allowPrivilegeEscalation
           label: "Allow Privilege Escalation"
           schema:
@@ -631,7 +631,7 @@ questions:
           label: "runAsNonRoot"
           schema:
             type: boolean
-            default: true
+            default: false
 
   - variable: podSecurityContext
     group: "Security and Permissions"
@@ -644,13 +644,13 @@ questions:
           description: "The UserID of the user running the application"
           schema:
             type: int
-            default: 568
+            default: 0
         - variable: runAsGroup
           label: "runAsGroup"
           description: The groupID this App of the user running the application"
           schema:
             type: int
-            default: 568
+            default: 0
         - variable: fsGroup
           label: "fsGroup"
           description: "The group that should own ALL storage."
diff --git a/charts/stable/deepstack-cpu/values.yaml b/charts/stable/deepstack-cpu/values.yaml
index ce7e32200ff..c479288abe6 100644
--- a/charts/stable/deepstack-cpu/values.yaml
+++ b/charts/stable/deepstack-cpu/values.yaml
@@ -12,6 +12,14 @@ service:
       main:
         port: 5000
 
+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
+podSecurityContext:
+  runAsUser: 0
+  runAsGroup: 0
+
 envTpl:
   # Permissions Settings
   USER_ID: "{{ .Values.env.PUID }}"