Unable to set fsGroup other than 1000 in helm chart #8724

New Issue

GiteaMirror · 2025-11-02T08:15:37-06:00

GiteaMirror commented

2025-11-02 08:15:37 -06:00

Originally created by @tgckpg on GitHub (Mar 19, 2022).

Gitea Version

1.16.4-rootless

Git Version

No response

Operating System

5.10.0-10-amd64 #1 SMP Debian 5.10.84-1 (2021-12-08) x86_64 GNU/Linux

How are you running Gitea?

Pod failed to run with the following config

values.yaml snippet

# Security context is only usable with rootless image due to image design
podSecurityContext:
  fsGroup: 1001

containerSecurityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
#   # Add the SYS_CHROOT capability for root and rootless images if you intend to
#   # run pods on nodes that use the container runtime cri-o. Otherwise, you will
#   # get an error message from the SSH server that it is not possible to read from
#   # the repository.
#   # https://gitea.com/gitea/helm-chart/issues/161
    add:
      - SYS_CHROOT
  privileged: false
  readOnlyRootFilesystem: true
  runAsGroup: 1001
  runAsNonRoot: true
  runAsUser: 1001

Database

PostgreSQL

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Description

No response

Screenshots

No response

Originally created by @tgckpg on GitHub (Mar 19, 2022). ### Gitea Version 1.16.4-rootless ### Git Version _No response_ ### Operating System 5.10.0-10-amd64 #1 SMP Debian 5.10.84-1 (2021-12-08) x86_64 GNU/Linux ### How are you running Gitea? Pod failed to run with the following config values.yaml snippet ``` # Security context is only usable with rootless image due to image design podSecurityContext: fsGroup: 1001 containerSecurityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL # # Add the SYS_CHROOT capability for root and rootless images if you intend to # # run pods on nodes that use the container runtime cri-o. Otherwise, you will # # get an error message from the SSH server that it is not possible to read from # # the repository. # # https://gitea.com/gitea/helm-chart/issues/161 add: - SYS_CHROOT privileged: false readOnlyRootFilesystem: true runAsGroup: 1001 runAsNonRoot: true runAsUser: 1001 ``` ### Database PostgreSQL ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Description _No response_ ### Screenshots _No response_

GiteaMirror closed this issue

2025-11-02 08:15:38 -06:00

GiteaMirror commented

2025-11-02 08:15:38 -06:00

@tgckpg commented on GitHub (Mar 19, 2022):

Found a workaround, create a pvc and mount it to /var/lib/gitea.

values.yaml

extraVolumes:
  - name: var-lib-gitea
    persistentVolumeClaim:
      claimName: var-lib-gitea

# additional volumes to mount, both to the init container and to the main
# container. As an example, can be used to mount a client cert when connecting
# to an external Postgres server.
extraVolumeMounts:
  - name: var-lib-gitea
    mountPath: "/var/lib/gitea"

@tgckpg commented on GitHub (Mar 19, 2022): Found a workaround, create a pvc and mount it to `/var/lib/gitea`. values.yaml ```yaml extraVolumes: - name: var-lib-gitea persistentVolumeClaim: claimName: var-lib-gitea # additional volumes to mount, both to the init container and to the main # container. As an example, can be used to mount a client cert when connecting # to an external Postgres server. extraVolumeMounts: - name: var-lib-gitea mountPath: "/var/lib/gitea" ```

GiteaMirror commented

2025-11-02 08:15:38 -06:00

@justusbunsi commented on GitHub (Jun 4, 2022):

Hi @tgckpg. Thanks for reporting. This is a direct issue in the Helm Chart. Do you mind creating an issue on https://gitea.com/gitea/helm-chart and close this one here?

EDIT: Issue created https://gitea.com/gitea/helm-chart/issues/338. Closing this one.

@justusbunsi commented on GitHub (Jun 4, 2022): Hi @tgckpg. Thanks for reporting. This is a direct issue in the Helm Chart. Do you mind creating an issue on https://gitea.com/gitea/helm-chart and close this one here? EDIT: Issue created https://gitea.com/gitea/helm-chart/issues/338. Closing this one.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#8724