From 441ddc4278d63aec11bb6a098a77c6ab2dffc0bf Mon Sep 17 00:00:00 2001
From: Julien Mailleret <8582351+jmlrt@users.noreply.github.com>
Date: Wed, 23 Dec 2020 11:04:22 +0100
Subject: [PATCH 1/2] [apm-server] run as non root user

This commit update APM server pod to run with UID 1000 instead of 0 (root).

Note that GID 0 is still required due to apm-server binary default files
permissions.

Fix #785
---
 apm-server/values.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/apm-server/values.yaml b/apm-server/values.yaml
index 5165f4fcd..3642aed43 100755
--- a/apm-server/values.yaml
+++ b/apm-server/values.yaml
@@ -82,7 +82,8 @@ podAnnotations: {}
 labels: {}
 
 podSecurityContext:
-  runAsUser: 0
+  runAsUser: 1000
+  runAsGroup: 0
   privileged: false
 
 livenessProbe:

From e2827bdd55641e8712bbf2dd8d00c0976f33c611 Mon Sep 17 00:00:00 2001
From: Julien Mailleret <8582351+jmlrt@users.noreply.github.com>
Date: Tue, 5 Jan 2021 10:16:23 +0100
Subject: [PATCH 2/2] add a pod security context

This is required to add fsGroup
---
 apm-server/templates/deployment.yaml |  8 ++++++--
 apm-server/tests/apmserver_test.py   | 16 +++++++++++++---
 apm-server/values.yaml               |  6 ++++++
 3 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/apm-server/templates/deployment.yaml b/apm-server/templates/deployment.yaml
index ca3248cd2..fa87cfa5a 100644
--- a/apm-server/templates/deployment.yaml
+++ b/apm-server/templates/deployment.yaml
@@ -30,6 +30,10 @@ spec:
         configChecksum: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum | trunc 63 }}
         {{- end }}
     spec:
+{{- if .Values.podSecurityContext }}
+      securityContext:
+{{ toYaml .Values.podSecurityContext | indent 10 }}
+{{- end }}
 {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
 {{- end }}
@@ -84,9 +88,9 @@ spec:
         envFrom:
 {{ toYaml .Values.envFrom | indent 10 }}
         {{- end }}
-{{- if .Values.podSecurityContext }}
+{{- if .Values.securityContext }}
         securityContext:
-{{ toYaml .Values.podSecurityContext | indent 10 }}
+{{ toYaml .Values.securityContext | indent 10 }}
 {{- end }}
         livenessProbe:
 {{ toYaml .Values.livenessProbe | indent 10 }}
diff --git a/apm-server/tests/apmserver_test.py b/apm-server/tests/apmserver_test.py
index b6b8218af..c86a5348d 100644
--- a/apm-server/tests/apmserver_test.py
+++ b/apm-server/tests/apmserver_test.py
@@ -146,16 +146,26 @@ def test_self_managing_rbac_resources():
     assert "clusterrolebinding" not in r
 
 
+def test_setting_container_security_context():
+    config = """
+securityContext:
+  runAsUser: 1001
+  privileged: true
+"""
+    r = helm_template(config)
+    c = r["deployment"][name]["spec"]["template"]["spec"]["containers"][0]
+    assert c["securityContext"]["runAsUser"] == 1001
+    assert c["securityContext"]["privileged"] is True
+
+
 def test_setting_pod_security_context():
     config = """
 podSecurityContext:
   runAsUser: 1001
-  privileged: false
 """
     r = helm_template(config)
-    c = r["deployment"][name]["spec"]["template"]["spec"]["containers"][0]
+    c = r["deployment"][name]["spec"]["template"]["spec"]
     assert c["securityContext"]["runAsUser"] == 1001
-    assert c["securityContext"]["privileged"] is False
 
 
 def test_adding_in_apm_config():
diff --git a/apm-server/values.yaml b/apm-server/values.yaml
index 3642aed43..19e2076bd 100755
--- a/apm-server/values.yaml
+++ b/apm-server/values.yaml
@@ -82,9 +82,15 @@ podAnnotations: {}
 labels: {}
 
 podSecurityContext:
+  fsGroup: 1000
   runAsUser: 1000
   runAsGroup: 0
+
+securityContext:
   privileged: false
+  runAsNonRoot: true
+  runAsUser: 1000
+  runAsGroup: 0
 
 livenessProbe:
   httpGet: