Update Grafana securityContext in Prometheus Stack to enforce non-root user settings

2026-07-30 17:23:31 +03:00 · 2026-07-30 17:23:31 +03:00 · 7553651efd
commit 7553651efd
parent 23d3c7ee31
1 changed files with 13 additions and 0 deletions
--- a/clusters/wb/infrastructure/patches/prometheus-stack.yaml
+++ b/clusters/wb/infrastructure/patches/prometheus-stack.yaml
@ -86,6 +86,19 @@ spec:
                  - pilot
    grafana:
      enabled: true
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 472
+        runAsGroup: 472
+        fsGroup: 472
+      initChownData:
+        enabled: true
+        securityContext:
+          runAsNonRoot: false
+          runAsUser: 0
+          capabilities:
+            add: ["CHOWN"]
+            drop: ["ALL"]
      adminUser: grafana-admin
      admin:
        existingSecret: grafana-admin