Prometheus Security Context (#973)

* Prometheus Security Context

Signed-off-by: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com>

* Missing files

Signed-off-by: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com>

Author: dvaldivia

models/prometheus_configuration.go

@@ -395,11 +395,11 @@ func getTenantCreds(ctx context.Context, client K8sClientI, tenant *miniov2.Tena
 }
 
 func getTenant(ctx context.Context, operatorClient OperatorClientI, namespace, tenantName string) (*miniov2.Tenant, error) {
-	minInst, err := operatorClient.TenantGet(ctx, namespace, tenantName, metav1.GetOptions{})
+	tenant, err := operatorClient.TenantGet(ctx, namespace, tenantName, metav1.GetOptions{})
 	if err != nil {
 		return nil, err
 	}
-	return minInst, nil
+	return tenant, nil
 }
 
 func isPrometheusEnabled(annotations map[string]string) bool {
@@ -1309,6 +1309,16 @@ func getTenantCreatedResponse(session *models.Principal, params operator_api.Cre
 	if prometheusImage != "" {
 		minInst.Spec.Prometheus.Image = prometheusImage
 	}
+	// if security context for prometheus is present, configure it.
+	if tenantReq.PrometheusConfiguration != nil && tenantReq.PrometheusConfiguration.SecurityContext != nil {
+		sc := tenantReq.PrometheusConfiguration.SecurityContext
+		minInst.Spec.Prometheus.SecurityContext = &corev1.PodSecurityContext{
+			RunAsUser:    sc.RunAsUser,
+			RunAsGroup:   sc.RunAsGroup,
+			RunAsNonRoot: sc.RunAsNonRoot,
+			FSGroup:      sc.FsGroup,
+		}
+	}
 
 	// expose services
 	minInst.Spec.ExposeServices = &miniov2.ExposeServices{

models/security_context.go

@@ -1317,6 +1317,9 @@ definitions:
         default: 5
       image:
         type: string
+      securityContext:
+        type: object
+        $ref: '#/definitions/securityContext'
   idpConfiguration:
     type: object
     properties:
@@ -2263,3 +2266,23 @@ definitions:
           type: string
       force:
         type: boolean
+  securityContext:
+     type: object
+     required:
+       - runAsUser
+       - runAsGroup
+       - runAsNonRoot
+       - fsGroup
+     properties:
+       runAsUser:
+         type: integer
+         format: int64
+       runAsGroup:
+         type: integer
+         format: int64
+       runAsNonRoot:
+         type: boolean
+       fsGroup:
+         type: integer
+         format: int64
+