🐛 Set fsGroup on hub pod to prevent read/write errors on PVC mounts

[jmontleon]

Summary by CodeRabbit

• New Features
  • Enhanced OpenShift environment support with improved security context configuration for initialization containers, enabling optimized permission handling for mounted volumes during container initialization.

[coderabbitai]

Warning

Rate limit exceeded

@jmontleon has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 9 minutes and 26 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 909fc9d5-bdcf-4432-9fb0-204cb3753976

📥 Commits

Reviewing files that changed from the base of the PR and between 40f92bb and 480c2db.

📒 Files selected for processing (1)

• roles/tackle/templates/deployment-hub.yml.j2

📝 Walkthrough

Walkthrough

Adds a conditional OpenShift-specific securityContext configuration to an init container in the deployment template. When running on OpenShift clusters, the init container now receives an fsGroup setting based on the hub_uid variable to manage mounted volume permissions appropriately.

Changes

Cohort / File(s)	Summary
OpenShift Init Container Security Configuration roles/tackle/templates/deployment-hub.yml.j2	Introduces conditional fsGroup securityContext for init container in OpenShift deployments, ensuring proper volume permission handling.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A container once worried about rights,
On OpenShift's secure, guarded heights,
With fsGroup set true,
Permissions shone through,
The hub dances free—what a sight! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding fsGroup configuration to the hub pod to fix PVC mount read/write errors, which aligns with the OpenShift securityContext modification in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@roles/tackle/templates/deployment-hub.yml.j2`:
- Around line 262-265: The securityContext fsGroup block is currently nested
under the enable_chown_init_container guard so OpenShift pods only get fsGroup
when that init container is enabled; move the {% if openshift_cluster %} ...
securityContext: fsGroup: {{ hub_uid }} {% endif %} block out of the
enable_chown_init_container conditional and place it at the
pod/spec/template/spec level (i.e. the main pod securityContext) so it is
applied whenever openshift_cluster is true regardless of
enable_chown_init_container; update indentation and surrounding conditionals
accordingly and keep the existing variable names securityContext, fsGroup,
openshift_cluster and enable_chown_init_container to locate the code.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6ada2aa0-1538-4980-b2b0-72e5012761e2

📥 Commits

Reviewing files that changed from the base of the PR and between fe31a8c and 40f92bb.

📒 Files selected for processing (1)

• roles/tackle/templates/deployment-hub.yml.j2

[konveyor-ci-bot]

PR cherry-picked to branch release-0.9. Backport PR: #551