From 64d010757c44a28d7127181c3b0de3da533cb1f1 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Tue, 21 Mar 2023 12:39:59 +0100
Subject: [PATCH] Resolve issue in prod example on volume mount (#143)

---
 examples/production/README.md   | 8 +++++++-
 examples/production/values.yaml | 4 ++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/examples/production/README.md b/examples/production/README.md
index 77f3b78..4cf892c 100644
--- a/examples/production/README.md
+++ b/examples/production/README.md
@@ -1,8 +1,14 @@
-Install with something similar to:
+# Recommended production setup
 
+Too install Spire with the least privileges possible we deploy spire accross 2 namespaces.
+
+```shell
 kubectl create namespace "spire-system"
 kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
 kubectl create namespace "spire-server"
 kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
 
 helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml
+```
+
+See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
diff --git a/examples/production/values.yaml b/examples/production/values.yaml
index 7658760..b18767e 100644
--- a/examples/production/values.yaml
+++ b/examples/production/values.yaml
@@ -10,6 +10,8 @@ spiffe-oidc-discovery-provider:
   podSecurityContext:
     runAsUser: 1000
     runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
   securityContext:
     allowPrivilegeEscalation: false
     runAsNonRoot: true
@@ -29,6 +31,8 @@ spire-server:
   podSecurityContext:
     runAsUser: 1000
     runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
   securityContext:
     allowPrivilegeEscalation: false
     runAsNonRoot: true