From 7553651efd907f4bb06b3eed97457be3628913e8 Mon Sep 17 00:00:00 2001
From: emelinda <emelin_d_a@mail.ru>
Date: Thu, 30 Jul 2026 17:23:31 +0300
Subject: [PATCH] Update Grafana securityContext in Prometheus Stack to enforce
 non-root user settings

---
 .../wb/infrastructure/patches/prometheus-stack.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/clusters/wb/infrastructure/patches/prometheus-stack.yaml b/clusters/wb/infrastructure/patches/prometheus-stack.yaml
index 8fd3c78..91857fc 100644
--- a/clusters/wb/infrastructure/patches/prometheus-stack.yaml
+++ b/clusters/wb/infrastructure/patches/prometheus-stack.yaml
@@ -86,6 +86,19 @@ spec:
                   - pilot
     grafana:
       enabled: true
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 472
+        runAsGroup: 472
+        fsGroup: 472
+      initChownData:
+        enabled: true
+        securityContext:
+          runAsNonRoot: false
+          runAsUser: 0
+          capabilities:
+            add: ["CHOWN"]
+            drop: ["ALL"]
       adminUser: grafana-admin
       admin:
         existingSecret: grafana-admin