From 5a8f2d671395d897eca0b38e4ad45156e5046e1b Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Wed, 15 Jul 2026 03:32:43 +0200
Subject: [PATCH] =?UTF-8?q?fix(pikaoa):=20=E4=BF=AE=E6=AD=A3=E9=99=84?=
 =?UTF-8?q?=E4=BB=B6=E5=8D=B7=20nonroot=20=E5=86=99=E6=9D=83=E9=99=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 config/fixtures/pikaoa-test-target.yaml      | 1 +
 config/pikaoa.yaml                           | 1 +
 scripts/src/pikaoa-test-target-async.test.ts | 1 +
 scripts/src/pikaoa-test-target.ts            | 9 +++++++++
 4 files changed, 12 insertions(+)

diff --git a/config/fixtures/pikaoa-test-target.yaml b/config/fixtures/pikaoa-test-target.yaml
index 5d0dff99..bb537c7c 100644
--- a/config/fixtures/pikaoa-test-target.yaml
+++ b/config/fixtures/pikaoa-test-target.yaml
@@ -56,6 +56,7 @@ testRuntime:
           claimName: pikaoa-attachments
           storageRequest: 1Gi
           storageClassName: null
+          fsGroup: 65532
           accessModes:
             - ReadWriteOnce
         workerInterval: 2s
diff --git a/config/pikaoa.yaml b/config/pikaoa.yaml
index 762f51bd..88ac9b8c 100644
--- a/config/pikaoa.yaml
+++ b/config/pikaoa.yaml
@@ -75,6 +75,7 @@ testRuntime:
           claimName: pikaoa-attachments
           storageRequest: 10Gi
           storageClassName: null
+          fsGroup: 65532
           accessModes:
             - ReadWriteOnce
         workerInterval: 2s
diff --git a/scripts/src/pikaoa-test-target-async.test.ts b/scripts/src/pikaoa-test-target-async.test.ts
index 72ab5103..3749882a 100644
--- a/scripts/src/pikaoa-test-target-async.test.ts
+++ b/scripts/src/pikaoa-test-target-async.test.ts
@@ -169,6 +169,7 @@ exit 64
     const objects = plan.objects as Array<Record<string, unknown>>;
     assert.equal(objects.some((object) => object.kind === "StatefulSet" || object.name === "pikaoa-postgres"), false);
     assert.equal(objects.some((object) => object.kind === "Deployment" && object.name === "pikaoa-web"), true);
+    assert.equal(objects.find((object) => object.kind === "Deployment" && object.name === "pikaoa-api")?.podFsGroup, 65532);
     assert.deepEqual(plan.exposure, { serviceType: "NodePort", serviceName: "pikaoa-web", hostIP: "192.0.2.10", port: 32080 });
 
     const missing = await projection("status", "runtime", false, "api");
diff --git a/scripts/src/pikaoa-test-target.ts b/scripts/src/pikaoa-test-target.ts
index 6054e266..79dea2ff 100644
--- a/scripts/src/pikaoa-test-target.ts
+++ b/scripts/src/pikaoa-test-target.ts
@@ -78,6 +78,7 @@ interface TestTargetSpec {
       claimName: string;
       storageRequest: string;
       storageClassName: string | null;
+      fsGroup: number;
       accessModes: string[];
     };
     workerInterval: string;
@@ -351,6 +352,7 @@ function parseTarget(id: string, root: Record<string, unknown>, configLabel: str
         claimName: kubernetesName(nonEmpty(attachment.claimName, `${path}.runtime.attachment.claimName`), `${path}.runtime.attachment.claimName`, 63),
         storageRequest: nonEmpty(attachment.storageRequest, `${path}.runtime.attachment.storageRequest`),
         storageClassName: nullableString(attachment.storageClassName, `${path}.runtime.attachment.storageClassName`),
+        fsGroup: positiveInteger(attachment.fsGroup, `${path}.runtime.attachment.fsGroup`, 2_147_483_647),
         accessModes: enumStringList(attachment.accessModes, `${path}.runtime.attachment.accessModes`, ["ReadWriteOnce", "ReadOnlyMany", "ReadWriteMany", "ReadWriteOncePod"]),
       },
       workerInterval: duration(runtime.workerInterval, `${path}.runtime.workerInterval`),
@@ -506,6 +508,7 @@ function renderedPlan(selection: Selection, context: RenderContext): Record<stri
       claimName: target.runtime.attachment.claimName,
       storageRequest: target.runtime.attachment.storageRequest,
       storageClassName: target.runtime.attachment.storageClassName,
+      fsGroup: target.runtime.attachment.fsGroup,
       accessModes: target.runtime.attachment.accessModes,
     },
     migration: {
@@ -745,6 +748,7 @@ function deployment(
       template: {
         metadata: { labels: { ...labels, ...selector }, annotations },
         spec: {
+          ...(component === "api" ? { securityContext: { fsGroup: target.runtime.attachment.fsGroup } } : {}),
           containers: [{
             name: component, image, imagePullPolicy: target.source.pullPolicy, env,
             ports: [{ name: component === "worker" ? "metrics" : "http", containerPort: port }],
@@ -1450,10 +1454,15 @@ function namespaceAnnotations(target: TestTargetSpec, context: RenderContext): R
 function objectSummary(object: Record<string, unknown>): Record<string, unknown> {
   const metadata = optionalRecord(object.metadata, "metadata") ?? {};
   const labels = optionalRecord(metadata.labels, "metadata.labels") ?? {};
+  const spec = optionalRecord(object.spec, "spec") ?? {};
+  const template = optionalRecord(spec.template, "spec.template") ?? {};
+  const podSpec = optionalRecord(template.spec, "spec.template.spec") ?? {};
+  const securityContext = optionalRecord(podSpec.securityContext, "spec.template.spec.securityContext") ?? {};
   return {
     kind: object.kind ?? null,
     name: metadata.name ?? null,
     owned: labels["app.kubernetes.io/managed-by"] === MANAGED_BY && labels[TEST_RUNTIME_LABEL] === "true" && typeof labels[TARGET_LABEL] === "string" && typeof labels[INSTANCE_LABEL] === "string",
+    podFsGroup: securityContext.fsGroup,
     secretValuesRedacted: object.kind === "Secret" ? true : undefined,
   };
 }