Skip to content

fix(redis-ha): hostPath chown init container must run as root#406

Merged
DandyDeveloper merged 4 commits into
masterfrom
fix/hostpath-chown-security-396
Jun 14, 2026
Merged

fix(redis-ha): hostPath chown init container must run as root#406
DandyDeveloper merged 4 commits into
masterfrom
fix/hostpath-chown-security-396

Conversation

@DandyDeveloper

@DandyDeveloper DandyDeveloper commented Jun 14, 2026

Copy link
Copy Markdown
Owner

Problem

Closes #396

When hostPath.chown=true, the hostpath-chown init container was inheriting the pod's containerSecurityContext via the compatibility.renderSecurityContext helper. This meant it ran with runAsNonRoot: true and runAsUser: 1000, causing chown to fail with "Permission denied" — you cannot change file ownership as a non-root user on a host-mounted directory.

Additionally, the chown command only set the user portion of the ownership (runAsUser), leaving the group ownership unchanged and not matching the pod's fsGroup.

Fix

  1. Override securityContext for this init container only — set runAsUser: 0 and runAsNonRoot: false explicitly, so the hostpath-chown init container runs as root (required to chown a host-mounted path). All other containers are unaffected and continue to use the non-root containerSecurityContext.

  2. Set uid:gid ownership — change the chown argument from "{{ .Values.containerSecurityContext.runAsUser }}" to "{{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}" so both user and group ownership are set correctly, matching the pod-level fsGroup (default: 1000) used at runtime.

Changes

charts/redis-ha/templates/redis-ha-statefulset.yaml

  • Replace inherited securityContext with explicit runAsUser: 0 / runAsNonRoot: false for the hostpath-chown init container
  • Expand chown target from uid to uid:gid

@DandyDeveloper DandyDeveloper merged commit 065bc67 into master Jun 14, 2026
2 checks passed
@DandyDeveloper DandyDeveloper deleted the fix/hostpath-chown-security-396 branch June 14, 2026 23:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[chart/redis-ha] hostPath.chown init container fails because non-root securityContext prevents chown

2 participants