fix: add openshift flag for openshift deployments

Author: sweb

deploy/helm/postgresql-trino-gateway/Chart.yaml

@@ -3,7 +3,7 @@ apiVersion: v2
 name: postgresql-trino-gateway
 description: PostgreSQL wire-protocol gateway in front of Trino, enabling Power BI DirectQuery and other PG-only clients.
 type: application
-version: 0.1.0
+version: 0.1.1
 appVersion: "0.1.0"
 home: https://stackable.tech
 sources:

deploy/helm/postgresql-trino-gateway/README.md

@@ -51,6 +51,30 @@ not configured here.
 and `trino.ssl=false` (cleartext password forwarded to Trino over plain
 HTTP). Use only with a loopback or otherwise-trusted Trino.
 
+## OpenShift
+
+By default the chart pins `runAsUser`, `runAsGroup` and `fsGroup` to the
+IDs baked into the image (the `stackable` user). OpenShift's SCCs (e.g.
+`restricted-v2`) instead assign a UID/fsGroup from a per-namespace range
+and reject any pod requesting IDs outside it, so the defaults fail
+admission with `... is not an allowed group` / `must be in the ranges`.
+
+Set `openshift.enabled=true` to omit `runAsUser`, `runAsGroup` and
+`fsGroup` from the pod and container security contexts, letting the SCC
+inject them:
+
+```bash
+helm install gw ./deploy/helm/postgresql-trino-gateway \
+    --set trino.host=trino.example.com \
+    --set openshift.enabled=true
+```
+
+The image is built for this: `/stackable` is group-`0`-owned with `g=u`
+permissions and the chart sets `readOnlyRootFilesystem: true`, so the
+container runs correctly as an arbitrary assigned UID with GID `0`. All
+other hardening (`runAsNonRoot`, `seccompProfile`, dropped capabilities)
+is retained.
+
 ## Connectivity
 
 The Service is `ClusterIP` on TCP/5432 by default. PG protocol is not
@@ -100,6 +124,8 @@ See `values.yaml` for the full list. Notable groups:
 - `livenessProbe`, `readinessProbe`, `startupProbe` — TCP socket probes.
 - `podSecurityContext`, `securityContext` — non-root, read-only root FS,
   drop ALL capabilities.
+- `openshift.enabled` — drop hardcoded UID/GID/fsGroup so OpenShift SCCs
+  assign them (see [OpenShift](#openshift)).
 - `maxConnections` — concurrent connection cap.
 - `logLevel` — `RUST_LOG` value (e.g. `postgresql_trino_gateway=debug`).
 

deploy/helm/postgresql-trino-gateway/templates/deployment.yaml

@@ -43,11 +43,21 @@ spec:
       serviceAccountName: {{ include "postgresql-trino-gateway.serviceAccountName" . }}
       terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
       securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+        {{- $podSecurityContext := deepCopy .Values.podSecurityContext }}
+        {{- if .Values.openshift.enabled }}
+        {{- $_ := unset $podSecurityContext "runAsUser" }}
+        {{- $_ := unset $podSecurityContext "runAsGroup" }}
+        {{- $_ := unset $podSecurityContext "fsGroup" }}
+        {{- end }}
+        {{- toYaml $podSecurityContext | nindent 8 }}
       containers:
         - name: gateway
           securityContext:
-            {{- toYaml .Values.securityContext | nindent 12 }}
+            {{- $securityContext := deepCopy .Values.securityContext }}
+            {{- if .Values.openshift.enabled }}
+            {{- $_ := unset $securityContext "runAsUser" }}
+            {{- end }}
+            {{- toYaml $securityContext | nindent 12 }}
           image: {{ include "postgresql-trino-gateway.image" . }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:

deploy/helm/postgresql-trino-gateway/values.yaml

@@ -28,6 +28,15 @@ serviceAccount:
 podAnnotations: {}
 podLabels: {}
 
+# OpenShift assigns a per-namespace UID/GID/fsGroup range via its SCCs
+# (e.g. restricted-v2) and rejects pods that request values outside it.
+# When enabled=true the chart omits runAsUser, runAsGroup and fsGroup from
+# the pod and container securityContext so OpenShift injects them from the
+# namespace range. The image (/stackable is group-0 owned with g=u perms,
+# readOnlyRootFilesystem is set) already runs as an arbitrary UID+GID 0.
+openshift:
+  enabled: false
+
 podSecurityContext:
   runAsNonRoot: true
   runAsUser: 782252253