From dff606634bd5779c491bbc16af85495791adbc6f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20Tich=C3=A1k?= <michal.tichak@cern.ch>
Date: Thu, 16 Jul 2026 14:45:59 +0200
Subject: [PATCH] [control-operator] proper privileges added to task-templates
 manifests

---
 .../ecs-manifests/task-templates/readout-tasktemplate.yaml   | 5 +++++
 .../task-templates/stfbuilder-senderoutput-tasktemplate.yaml | 4 ++++
 .../ecs-manifests/task-templates/stfsender-tasktemplate.yaml | 4 ++++
 3 files changed, 13 insertions(+)

diff --git a/control-operator/ecs-manifests/task-templates/readout-tasktemplate.yaml b/control-operator/ecs-manifests/task-templates/readout-tasktemplate.yaml
index 467470ce..3442286e 100644
--- a/control-operator/ecs-manifests/task-templates/readout-tasktemplate.yaml
+++ b/control-operator/ecs-manifests/task-templates/readout-tasktemplate.yaml
@@ -12,12 +12,17 @@ spec:
   pod:
     hostNetwork: true
     hostIPC: true
+    securityContext:
+      fsGroup: 1100
+      supplementalGroups: [10, 1105]
     containers:
       - name: readout
         image: gitlab-registry.cern.ch/aliceo2group/dockerfiles/alma9-flp-node/readout:1
         command: ["/opt/o2/bin/o2-readout-exe"]
         securityContext:
           privileged: true
+          runAsUser: 1100
+          runAsGroup: 1100
         volumeMounts:
           - name: host-shm
             mountPath: /dev/shm
diff --git a/control-operator/ecs-manifests/task-templates/stfbuilder-senderoutput-tasktemplate.yaml b/control-operator/ecs-manifests/task-templates/stfbuilder-senderoutput-tasktemplate.yaml
index 50e3b757..d42664f5 100644
--- a/control-operator/ecs-manifests/task-templates/stfbuilder-senderoutput-tasktemplate.yaml
+++ b/control-operator/ecs-manifests/task-templates/stfbuilder-senderoutput-tasktemplate.yaml
@@ -15,12 +15,16 @@ spec:
     hostNetwork: true
     hostIPC: true
     securityContext:
+      fsGroup: 1100
+      supplementalGroups: [10, 1105]
     containers:
       - name: stfbuilder
         image: gitlab-registry.cern.ch/aliceo2group/dockerfiles/alma9-flp-node/dd:1
         command: [/opt/o2/bin/StfBuilder]
         securityContext:
           privileged: true
+          runAsUser: 1100
+          runAsGroup: 1100
         volumeMounts:
           - name: host-shm
             mountPath: /dev/shm
diff --git a/control-operator/ecs-manifests/task-templates/stfsender-tasktemplate.yaml b/control-operator/ecs-manifests/task-templates/stfsender-tasktemplate.yaml
index 082b7309..715bed6f 100644
--- a/control-operator/ecs-manifests/task-templates/stfsender-tasktemplate.yaml
+++ b/control-operator/ecs-manifests/task-templates/stfsender-tasktemplate.yaml
@@ -22,12 +22,16 @@ spec:
     hostNetwork: true
     hostIPC: true
     securityContext:
+      fsGroup: 1100
+      supplementalGroups: [10, 1105]
     containers:
       - name: stfsender
         image: gitlab-registry.cern.ch/aliceo2group/dockerfiles/alma9-flp-node/dd:1
         command: ["numactl"]
         securityContext:
           privileged: true
+          runAsUser: 1100
+          runAsGroup: 1100
         volumeMounts:
           - name: host-shm
             mountPath: /dev/shm