CASMCMS-8060 Fix incomplete non-root cray-cfs-api changes

[dborman-hpe]

Summary and Scope

When the "cray-cfs-api" chart was converted to non-root, the change was incomplete. In addition to specifying a "securityContext" for the container, a "securityContext" also needs to be specified for the pod. This is what tells Kubernetes how to set up permissions on PVCs. Without that, the PVCs will have the default permissions of the underlying storage class, which can vary between storage classes.

The only reason things are currently working is because the CephFS storage class defaults to a top level directory of "root/root", mode "0x777". In Mercury we switch to a cStor storage class, where the default permissions are "0x755", and non-root containers are not able to create files.

Issues and Related PRs

• Resolves CASMCMS-8060

Testing

Tested on:

• Mercury

Test description:

Without this change the chart fails to deploy on Mercury systems. After patching the chart with this change, cray-cfs-api successfully deploys.

• Were the install/upgrade-based validation checks/tests run (goss tests/install-validation doc)?
• Were continuous integration tests run? If not, why?
• Was upgrade tested? If not, why?
• Was downgrade tested? If not, why?
• Were new tests (or test issues/Jiras) created for this change?

Risks and Mitigations

There should be no visible changes, other than inside the running container the PVC mount point should no longer be owned by root.

Pull Request Checklist

• Version number(s) incremented, if applicable
• Copyrights updated
• License file intact
• Target branch correct
• CHANGELOG.md updated
• Testing is appropriate and complete, if applicable
• HPC Product Announcement prepared, if applicable