From 605dea98ca928d62a5b61d63389c1e16e6fe53b5 Mon Sep 17 00:00:00 2001
From: bulbashenko <admin@bulbashenko.com>
Date: Sun, 11 Oct 2026 22:32:38 +0200
Subject: [PATCH] Give every pod a numeric runAsUser

The Ory images run as named users (ory, nonroot) and the UI as node, so
with runAsNonRoot the kubelet refused to start them (non-numeric user).
Set the ids explicitly: 10000 for Kratos/Keto/Oathkeeper, 65532 for
Hydra's distroless nonroot, 1000 for node.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 deploy/k8s/ory.yaml | 12 ++++++++++++
 deploy/k8s/ui.yaml  |  6 ++++++
 2 files changed, 18 insertions(+)

diff --git a/deploy/k8s/ory.yaml b/deploy/k8s/ory.yaml
index efd8c3e..a686410 100644
--- a/deploy/k8s/ory.yaml
+++ b/deploy/k8s/ory.yaml
@@ -15,6 +15,9 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
+        # Image users are named (ory/nonroot); the kubelet needs a numeric id to verify non-root.
+        runAsUser: 10000
+        runAsGroup: 10000
         seccompProfile: { type: RuntimeDefault }
       initContainers:
         - name: migrate
@@ -104,6 +107,9 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
+        # Image users are named (ory/nonroot); the kubelet needs a numeric id to verify non-root.
+        runAsUser: 65532
+        runAsGroup: 65532
         seccompProfile: { type: RuntimeDefault }
       initContainers:
         - name: migrate
@@ -173,6 +179,9 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
+        # Image users are named (ory/nonroot); the kubelet needs a numeric id to verify non-root.
+        runAsUser: 10000
+        runAsGroup: 10000
         seccompProfile: { type: RuntimeDefault }
       initContainers:
         - name: migrate
@@ -240,6 +249,9 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
+        # Image users are named (ory/nonroot); the kubelet needs a numeric id to verify non-root.
+        runAsUser: 10000
+        runAsGroup: 10000
         seccompProfile: { type: RuntimeDefault }
       containers:
         - name: oathkeeper
diff --git a/deploy/k8s/ui.yaml b/deploy/k8s/ui.yaml
index 9f67102..4bb2156 100644
--- a/deploy/k8s/ui.yaml
+++ b/deploy/k8s/ui.yaml
@@ -13,6 +13,9 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
+        # The image's user is `node` (uid 1000); the kubelet needs the numeric id.
+        runAsUser: 1000
+        runAsGroup: 1000
         seccompProfile: { type: RuntimeDefault }
       containers:
         - name: sso-ui
@@ -70,6 +73,9 @@ spec:
       restartPolicy: OnFailure
       securityContext:
         runAsNonRoot: true
+        # The image's user is `node` (uid 1000); the kubelet needs the numeric id.
+        runAsUser: 1000
+        runAsGroup: 1000
         seccompProfile: { type: RuntimeDefault }
       containers:
         - name: sync