added PodSecurityContext

cmd/create.go

@@ -1,4 +1,4 @@
 package cmd
 
 import (
 	"errors"
@@ -568,4 +568,4 @@
 	}
 	writer.Flush()
 	return builder.String(), nil
-}
+}

pkg/functions/function.go

@@ -1,4 +1,4 @@
 package functions
 
 import (
 	"errors"
@@ -141,7 +141,9 @@
 
 	// Env variables to be set
 	Envs Envs `yaml:"envs,omitempty"`
-
+
+	// PodSecurityContext to be set for read and write permission
+	PodSecurityContext PodSecurityContext `yaml:"podSecurityContext, omitempty"`
 	// StartTimeout specifies that this function should have a custom timeout
 	// when starting. This setting is currently respected by the host runner,
 	// with containerized docker runner and deployed Knative service integration

pkg/functions/function_security.go

@@ -0,0 +1,8 @@
+package functions
+
+type PodSecurityContext struct {
+    RunAsUser    *int64 `yaml:"RunAsUser,omitempty"`
+    RunAsGroup   *int64 `yaml:"RunAsGroup,omitempty"`
+    RunAsNonRoot *bool  `yaml:"RunAsNonRoot,omitempty"`
+    FSGroup      *int64 `yaml:"FSGroup,omitempty"`
+}

pkg/knative/deployer.go

@@ -1,4 +1,4 @@
 package knative
 
 import (
 	"context"
@@ -435,7 +435,7 @@
 	for k, v := range annotations {
 		revisionAnnotations[k] = v
 	}
-
+    PodSecurityContext := getPodSecurityContext(f.Run)
 	service := &v1.Service{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:        f.Name,
@@ -451,6 +451,7 @@
 					},
 					Spec: v1.RevisionSpec{
 						PodSpec: corev1.PodSpec{
+							SecurityContext: PodSecurityContext,
 							Containers: []corev1.Container{
 								container,
 							},
@@ -1075,3 +1076,13 @@
 
 	return servingclientlib.UpdateRevisionTemplateAnnotations(template, toUpdate, toRemove)
 }
+
+func getPodSecurityContext(RunSpec fn.RunSpec) *corev1.PodSecurityContext{
+    return &corev1.PodSecurityContext{
+		RunAsUser: RunSpec.PodSecurityContext.RunAsUser,
+		RunAsGroup: RunSpec.PodSecurityContext.RunAsGroup,
+		RunAsNonRoot: RunSpec.PodSecurityContext.RunAsNonRoot,
+		FSGroup: RunSpec.PodSecurityContext.FSGroup,
+	}
+
+}

schema/func_yaml-schema.json

@@ -16,7 +16,7 @@
 						}
 					},
 					"type": "object",
-					"description": "BuilderImages define optional explicit builder images to use by\nbuilder implementations in leau of the in-code defaults.  They key\nis the builder's short name.  For example:\nbuilderImages:\n  pack: example.com/user/my-pack-node-builder\n  s2i: example.com/user/my-s2i-node-builder"
+					"description// with containerized docker runner and deployed Knative service integration": "BuilderImages define optional explicit builder images to use by\nbuilder implementations in leau of the in-code defaults.  They key\nis the builder's short name.  For example:\nbuilderImages:\n  pack: example.com/user/my-pack-node-builder\n  s2i: example.com/user/my-s2i-node-builder"
 				},
 				"buildpacks": {
 					"items": {
@@ -352,6 +352,26 @@
 					"type": "array",
 					"description": "Env variables to be set"
 				},
+				"podSecurityContext": {
+					"properties": {
+						"RunAsUser": {
+							"pattern": "^[-._a-zA-Z][-._a-zA-Z0-9]*$",
+							"type": "integer"
+						},
+						"RunAsGroup": {
+							"type": "integer"
+						},
+						"RunAsNonRoot":{
+							"type": "boolean"
+						},
+						"FSGroup":{
+							"type":"integer"
+						}
+					},
+					"additionalProperties": false,
+					"type": "object"
+
+				},
 				"startTimeout": {
 					"type": "integer",
 					"description": "StartTimeout specifies that this function should have a custom timeout\nwhen starting. This setting is currently respected by the host runner,\nwith containerized docker runner and deployed Knative service integration\nin development."