explicitly set run as user/group in addons that set this config in their dockerfile

cluster/addons/calico-policy-controller/typha-horizontal-autoscaler-deployment.yaml

@@ -17,19 +17,22 @@ spec:
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
       priorityClassName: system-cluster-critical
+      securityContext:
+        supplementalGroups: [ 65534 ]
+        fsGroup: 65534
       containers:
-        - image: k8s.gcr.io/cluster-proportional-autoscaler-amd64:1.1.2-r2
+      - image: k8s.gcr.io/cluster-proportional-autoscaler-amd64:1.1.2-r2
-          name: autoscaler
+        name: autoscaler
-          command:
+        command:
-            - /cluster-proportional-autoscaler
+          - /cluster-proportional-autoscaler
-            - --namespace=kube-system
+          - --namespace=kube-system
-            - --configmap=calico-typha-horizontal-autoscaler
+          - --configmap=calico-typha-horizontal-autoscaler
-            - --target=deployment/calico-typha
+          - --target=deployment/calico-typha
-            - --logtostderr=true
+          - --logtostderr=true
-            - --v=2
+          - --v=2
-          resources:
+        resources:
-            requests:
+          requests:
-              cpu: 10m
+            cpu: 10m
-            limits:
+          limits:
-              cpu: 10m
+            cpu: 10m
       serviceAccountName: typha-cpha

cluster/addons/cluster-monitoring/google/heapster-controller.yaml

@@ -59,6 +59,9 @@ spec:
         seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
     spec:
       priorityClassName: system-cluster-critical
+      securityContext:
+        supplementalGroups: [ 65534 ]
+        fsGroup: 65534
       containers:
         - image: k8s.gcr.io/heapster-amd64:v1.6.0-beta.1
           name: heapster

cluster/addons/cluster-monitoring/googleinfluxdb/heapster-controller-combined.yaml

@@ -59,6 +59,9 @@ spec:
         seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
     spec:
       priorityClassName: system-cluster-critical
+      securityContext:
+        supplementalGroups: [ 65534 ]
+        fsGroup: 65534
       containers:
         - image: k8s.gcr.io/heapster-amd64:v1.6.0-beta.1
           name: heapster

cluster/addons/cluster-monitoring/influxdb/heapster-controller.yaml

@@ -59,6 +59,9 @@ spec:
         seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
     spec:
       priorityClassName: system-cluster-critical
+      securityContext:
+        supplementalGroups: [ 65534 ]
+        fsGroup: 65534
       containers:
         - image: k8s.gcr.io/heapster-amd64:v1.6.0-beta.1
           name: heapster

cluster/addons/cluster-monitoring/stackdriver/heapster-controller.yaml

@@ -46,6 +46,9 @@ spec:
         seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
     spec:
       priorityClassName: system-cluster-critical
+      securityContext:
+        supplementalGroups: [ 65534 ]
+        fsGroup: 65534
       containers:
         - image: k8s.gcr.io/heapster-amd64:v1.6.0-beta.1
           name: heapster

cluster/addons/cluster-monitoring/standalone/heapster-controller.yaml

@@ -46,6 +46,9 @@ spec:
         seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
     spec:
       priorityClassName: system-cluster-critical
+      securityContext:
+        supplementalGroups: [ 65534 ]
+        fsGroup: 65534
       containers:
         - image: k8s.gcr.io/heapster-amd64:v1.6.0-beta.1
           name: heapster

cluster/addons/dns-horizontal-autoscaler/dns-horizontal-autoscaler.yaml

@@ -80,6 +80,9 @@ spec:
         seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
     spec:
       priorityClassName: system-cluster-critical
+      securityContext:
+        supplementalGroups: [ 65534 ]
+        fsGroup: 65534
       containers:
       - name: autoscaler
         image: k8s.gcr.io/cluster-proportional-autoscaler-amd64:1.3.0

cluster/addons/dns/kube-dns/kube-dns.yaml.base

@@ -86,6 +86,9 @@ spec:
         seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
     spec:
       priorityClassName: system-cluster-critical
+      securityContext:
+        supplementalGroups: [ 65534 ]
+        fsGroup: 65534
       tolerations:
       - key: "CriticalAddonsOnly"
         operator: "Exists"

cluster/addons/dns/kube-dns/kube-dns.yaml.in

@@ -86,6 +86,9 @@ spec:
         seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
     spec:
       priorityClassName: system-cluster-critical
+      securityContext:
+        supplementalGroups: [ 65534 ]
+        fsGroup: 65534
       tolerations:
       - key: "CriticalAddonsOnly"
         operator: "Exists"

cluster/addons/dns/kube-dns/kube-dns.yaml.sed

@@ -86,6 +86,9 @@ spec:
         seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
     spec:
       priorityClassName: system-cluster-critical
+      securityContext:
+        supplementalGroups: [ 65534 ]
+        fsGroup: 65534
       tolerations:
       - key: "CriticalAddonsOnly"
         operator: "Exists"