From 2ef2f94a9cf11eddcc886f970c7fd1b6480dd1e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Florian=20M=C3=BCller?= Date: Wed, 15 Jul 2026 13:22:50 +0200 Subject: [PATCH 1/2] fix: add openshift flag for openshift deployments --- .../helm/postgresql-trino-gateway/Chart.yaml | 2 +- .../helm/postgresql-trino-gateway/README.md | 26 +++++++++++++++++++ .../templates/deployment.yaml | 14 ++++++++-- .../helm/postgresql-trino-gateway/values.yaml | 9 +++++++ 4 files changed, 48 insertions(+), 3 deletions(-) diff --git a/deploy/helm/postgresql-trino-gateway/Chart.yaml b/deploy/helm/postgresql-trino-gateway/Chart.yaml index 1411c15..2407737 100644 --- a/deploy/helm/postgresql-trino-gateway/Chart.yaml +++ b/deploy/helm/postgresql-trino-gateway/Chart.yaml @@ -3,7 +3,7 @@ apiVersion: v2 name: postgresql-trino-gateway description: PostgreSQL wire-protocol gateway in front of Trino, enabling Power BI DirectQuery and other PG-only clients. type: application -version: 0.1.0 +version: 0.1.1 appVersion: "0.1.0" home: https://stackable.tech sources: diff --git a/deploy/helm/postgresql-trino-gateway/README.md b/deploy/helm/postgresql-trino-gateway/README.md index d40d614..5b7aa88 100644 --- a/deploy/helm/postgresql-trino-gateway/README.md +++ b/deploy/helm/postgresql-trino-gateway/README.md @@ -51,6 +51,30 @@ not configured here. and `trino.ssl=false` (cleartext password forwarded to Trino over plain HTTP). Use only with a loopback or otherwise-trusted Trino. +## OpenShift + +By default the chart pins `runAsUser`, `runAsGroup` and `fsGroup` to the +IDs baked into the image (the `stackable` user). OpenShift's SCCs (e.g. +`restricted-v2`) instead assign a UID/fsGroup from a per-namespace range +and reject any pod requesting IDs outside it, so the defaults fail +admission with `... is not an allowed group` / `must be in the ranges`. + +Set `openshift.enabled=true` to omit `runAsUser`, `runAsGroup` and +`fsGroup` from the pod and container security contexts, letting the SCC +inject them: + +```bash +helm install gw ./deploy/helm/postgresql-trino-gateway \ + --set trino.host=trino.example.com \ + --set openshift.enabled=true +``` + +The image is built for this: `/stackable` is group-`0`-owned with `g=u` +permissions and the chart sets `readOnlyRootFilesystem: true`, so the +container runs correctly as an arbitrary assigned UID with GID `0`. All +other hardening (`runAsNonRoot`, `seccompProfile`, dropped capabilities) +is retained. + ## Connectivity The Service is `ClusterIP` on TCP/5432 by default. PG protocol is not @@ -100,6 +124,8 @@ See `values.yaml` for the full list. Notable groups: - `livenessProbe`, `readinessProbe`, `startupProbe` — TCP socket probes. - `podSecurityContext`, `securityContext` — non-root, read-only root FS, drop ALL capabilities. +- `openshift.enabled` — drop hardcoded UID/GID/fsGroup so OpenShift SCCs + assign them (see [OpenShift](#openshift)). - `maxConnections` — concurrent connection cap. - `logLevel` — `RUST_LOG` value (e.g. `postgresql_trino_gateway=debug`). diff --git a/deploy/helm/postgresql-trino-gateway/templates/deployment.yaml b/deploy/helm/postgresql-trino-gateway/templates/deployment.yaml index 6e03469..8e169d6 100644 --- a/deploy/helm/postgresql-trino-gateway/templates/deployment.yaml +++ b/deploy/helm/postgresql-trino-gateway/templates/deployment.yaml @@ -43,11 +43,21 @@ spec: serviceAccountName: {{ include "postgresql-trino-gateway.serviceAccountName" . }} terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- $podSecurityContext := deepCopy .Values.podSecurityContext }} + {{- if .Values.openshift.enabled }} + {{- $_ := unset $podSecurityContext "runAsUser" }} + {{- $_ := unset $podSecurityContext "runAsGroup" }} + {{- $_ := unset $podSecurityContext "fsGroup" }} + {{- end }} + {{- toYaml $podSecurityContext | nindent 8 }} containers: - name: gateway securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} + {{- $securityContext := deepCopy .Values.securityContext }} + {{- if .Values.openshift.enabled }} + {{- $_ := unset $securityContext "runAsUser" }} + {{- end }} + {{- toYaml $securityContext | nindent 12 }} image: {{ include "postgresql-trino-gateway.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: diff --git a/deploy/helm/postgresql-trino-gateway/values.yaml b/deploy/helm/postgresql-trino-gateway/values.yaml index 4f02234..10ec61d 100644 --- a/deploy/helm/postgresql-trino-gateway/values.yaml +++ b/deploy/helm/postgresql-trino-gateway/values.yaml @@ -28,6 +28,15 @@ serviceAccount: podAnnotations: {} podLabels: {} +# OpenShift assigns a per-namespace UID/GID/fsGroup range via its SCCs +# (e.g. restricted-v2) and rejects pods that request values outside it. +# When enabled=true the chart omits runAsUser, runAsGroup and fsGroup from +# the pod and container securityContext so OpenShift injects them from the +# namespace range. The image (/stackable is group-0 owned with g=u perms, +# readOnlyRootFilesystem is set) already runs as an arbitrary UID+GID 0. +openshift: + enabled: false + podSecurityContext: runAsNonRoot: true runAsUser: 782252253 From 494c64dc65dc3bfce401d154baff1bffc34f27bf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Florian=20M=C3=BCller?= Date: Wed, 15 Jul 2026 17:30:10 +0200 Subject: [PATCH 2/2] chore: shorten docs --- deploy/helm/postgresql-trino-gateway/README.md | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-) diff --git a/deploy/helm/postgresql-trino-gateway/README.md b/deploy/helm/postgresql-trino-gateway/README.md index 5b7aa88..43779e6 100644 --- a/deploy/helm/postgresql-trino-gateway/README.md +++ b/deploy/helm/postgresql-trino-gateway/README.md @@ -61,19 +61,7 @@ admission with `... is not an allowed group` / `must be in the ranges`. Set `openshift.enabled=true` to omit `runAsUser`, `runAsGroup` and `fsGroup` from the pod and container security contexts, letting the SCC -inject them: - -```bash -helm install gw ./deploy/helm/postgresql-trino-gateway \ - --set trino.host=trino.example.com \ - --set openshift.enabled=true -``` - -The image is built for this: `/stackable` is group-`0`-owned with `g=u` -permissions and the chart sets `readOnlyRootFilesystem: true`, so the -container runs correctly as an arbitrary assigned UID with GID `0`. All -other hardening (`runAsNonRoot`, `seccompProfile`, dropped capabilities) -is retained. +inject them. ## Connectivity