Hello, We are using DataHub deployed in GCP through helm charts. My organization enforces strict pod security context like

runAsNonRoot

I see that many of the pods deployed from DataHub helm charts support overriding

securityContext

through

values.yaml

files except the cronJobs created from datahub-ingestion-cron template file. Do you guys have a workaround to add/update

securityContext

for these cronJobs?

Hello @shy-dog-84302 I have the same issue, however I am struggling with log: would violate PodSecurity "restricted:v1.24": unrestricted capabilities (container "kafka" must set securityContext.capabilities.drop=["ALL"]) I have tried running helm upgrade with --set kafka.podSecurityContext.capabilities.drop=["ALL"] as well as with --set kafka.securityContext.capabilities.drop=["ALL"] but any of them does not solve the problem...

which particular application deployment/cronJob you are struggling to set

securityContext

for?

I'm running:

helm upgrade prerequisites datahub/datahub-prerequisites --values=values.txt --set elasticsearch.securityContext.allowPrivilegeEscalation=false --set kafka.podSecurityContext.capabilities.drop=["ALL"]

shouldn’t it be

elasticsearchSetupJob.securityContext.allowPrivilegeEscalation=false

?

I think setupjob is in datahub itself, not in prerequsits

I'm trying to do this as well, but I can not do it for the argument (container "kafka" must set securityContext.capabilities.drop=["ALL"])

Ah! I see that you are trying to set securityContext for the apps being installed as prerequisites.. then you should look in corresponding chart repo to see how securityContext is expected.. I do not do that.. I use pre-installed ES and Kafka services