Resolve issue in prod example on volume mount (#143)

examples/production/README.md

@@ -1,8 +1,14 @@
-Install with something similar to:
+# Recommended production setup
 
+Too install Spire with the least privileges possible we deploy spire accross 2 namespaces.
+
+```shell
 kubectl create namespace "spire-system"
 kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
 kubectl create namespace "spire-server"
 kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
 
 helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml
+```
+
+See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.

examples/production/values.yaml

@@ -10,6 +10,8 @@ spiffe-oidc-discovery-provider:
   podSecurityContext:
     runAsUser: 1000
     runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
   securityContext:
     allowPrivilegeEscalation: false
     runAsNonRoot: true
@@ -29,6 +31,8 @@ spire-server:
   podSecurityContext:
     runAsUser: 1000
     runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
   securityContext:
     allowPrivilegeEscalation: false
     runAsNonRoot: true