- Removed initContainer running as root (violates PodSecurity restricted:latest) - Removed shared emptyDir /etc mount (no longer needed) - Rely on fsGroup:1000 + runAsUser:1000 for volume ownership and container UID - Added runAsNonRoot: true to podSecurityContext and both containers for policy compliance Pod will now start, webui runs as UID 1000 == WANTED_UID, init.bash skips chown/sudo. |
||
|---|---|---|
| .. | ||
| api-server-configmap.yaml | ||
| configmap.yaml | ||
| deployment.yaml | ||
| hermes-secret.yaml | ||
| hermes-service.yaml | ||
| hermes-webui-service.yaml | ||
| kustomization.yaml | ||
| rays-deployment.yaml | ||
| rays-hermes-secret.yaml | ||