feat(helm): use fsGroupChangePolicy=OnRootMismatch to speed up pod starts (#13942)

sathieu · web-flow · commit c7cec3aa8192 · 2025-11-17T13:26:41.000-07:00
Signed-off-by: Mathieu Parent &lt;math.parent@gmail.com&gt;
diff --git a/docs/sources/setup/install/helm/reference.md b/docs/sources/setup/install/helm/reference.md
@@ -7087,6 +7087,7 @@ null
 			<td><pre lang="json">
 {
   "fsGroup": 10001,
+  "fsGroupChangePolicy": "OnRootMismatch",
   "runAsGroup": 10001,
   "runAsNonRoot": true,
   "runAsUser": 10001
diff --git a/production/helm/loki/CHANGELOG.md b/production/helm/loki/CHANGELOG.md
@@ -13,6 +13,7 @@ Entries should include a reference to the pull request that introduced the chang
 
 ## Unreleased
 
+- [ENHANCEMENT] Use fsGroupChangePolicy=OnRootMismatch on loki to speed up pod starts [#13942](https://github.com/grafana/loki/pull/13942)
 
 ## 6.46.0
 
diff --git a/production/helm/loki/templates/_helpers.tpl b/production/helm/loki/templates/_helpers.tpl
@@ -1267,3 +1267,14 @@ azure:
 storage_prefix: {{ .storage_prefix }}
 {{- end }}
 {{- end }}
+
+{{/*
+Pod security context
+*/}}
+{{- define "loki.podSecurityContext" -}}
+{{- if semverCompare ">=1.23-0" $.Capabilities.KubeVersion.GitVersion }}
+{{- toYaml .Values.loki.podSecurityContext }}
+{{- else }}
+{{- toYaml (omit .Values.loki.podSecurityContext "fsGroupChangePolicy")  }}
+{{- end }}
+{{- end -}}
diff --git a/production/helm/loki/templates/backend/statefulset-backend.yaml b/production/helm/loki/templates/backend/statefulset-backend.yaml
@@ -67,7 +67,7 @@ spec:
       {{- end }}
       {{- include "loki.backendPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.backend.terminationGracePeriodSeconds }}
       {{- if and (semverCompare ">=1.33-0" (include "loki.kubeVersion" .)) (kindIs "bool" .Values.backend.hostUsers) }}
       hostUsers: {{ .Values.backend.hostUsers }}
diff --git a/production/helm/loki/templates/bloom-builder/deployment-bloom-builder.yaml b/production/helm/loki/templates/bloom-builder/deployment-bloom-builder.yaml
@@ -58,7 +58,7 @@ spec:
       {{- end }}
       {{- include "loki.bloomBuilderPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.bloomBuilder.terminationGracePeriodSeconds }}
       {{- with .Values.bloomBuilder.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/bloom-gateway/statefulset-bloom-gateway.yaml b/production/helm/loki/templates/bloom-gateway/statefulset-bloom-gateway.yaml
@@ -62,7 +62,7 @@ spec:
       {{- end }}
       {{- include "loki.bloomGatewayPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.bloomGateway.terminationGracePeriodSeconds }}
       {{- with .Values.bloomGateway.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/bloom-planner/statefulset-bloom-planner.yaml b/production/helm/loki/templates/bloom-planner/statefulset-bloom-planner.yaml
@@ -62,7 +62,7 @@ spec:
       {{- end }}
       {{- include "loki.bloomPlannerPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.bloomPlanner.terminationGracePeriodSeconds }}
       {{- with .Values.bloomPlanner.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/compactor/statefulset-compactor.yaml b/production/helm/loki/templates/compactor/statefulset-compactor.yaml
@@ -69,7 +69,7 @@ spec:
       {{- end }}
       {{- include "loki.compactorPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.compactor.terminationGracePeriodSeconds }}
       {{- with .Values.compactor.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/distributor/deployment-distributor.yaml b/production/helm/loki/templates/distributor/deployment-distributor.yaml
@@ -65,7 +65,7 @@ spec:
       {{- end }}
       {{- include "loki.distributorPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.distributor.terminationGracePeriodSeconds }}
       {{- with .Values.distributor.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/index-gateway/statefulset-index-gateway.yaml b/production/helm/loki/templates/index-gateway/statefulset-index-gateway.yaml
@@ -68,7 +68,7 @@ spec:
       {{- end }}
       {{- include "loki.indexGatewayPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.indexGateway.terminationGracePeriodSeconds }}
       {{- with .Values.indexGateway.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/ingester/statefulset-ingester-zone-a.yaml b/production/helm/loki/templates/ingester/statefulset-ingester-zone-a.yaml
@@ -93,7 +93,7 @@ spec:
       {{- end }}
       {{- include "loki.ingesterPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.ingester.terminationGracePeriodSeconds }}
       {{- with .Values.ingester.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/ingester/statefulset-ingester-zone-b.yaml b/production/helm/loki/templates/ingester/statefulset-ingester-zone-b.yaml
@@ -93,7 +93,7 @@ spec:
       {{- end }}
       {{- include "loki.ingesterPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.ingester.terminationGracePeriodSeconds }}
       {{- with .Values.ingester.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/ingester/statefulset-ingester-zone-c.yaml b/production/helm/loki/templates/ingester/statefulset-ingester-zone-c.yaml
@@ -93,7 +93,7 @@ spec:
       {{- end }}
       {{- include "loki.ingesterPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.ingester.terminationGracePeriodSeconds }}
       {{- with .Values.ingester.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/ingester/statefulset-ingester.yaml b/production/helm/loki/templates/ingester/statefulset-ingester.yaml
@@ -79,7 +79,7 @@ spec:
       {{- end }}
       {{- include "loki.ingesterPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.ingester.terminationGracePeriodSeconds }}
       {{- with .Values.ingester.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/loki-canary/daemonset.yaml b/production/helm/loki/templates/loki-canary/daemonset.yaml
@@ -47,7 +47,7 @@ spec:
       hostUsers: {{ .hostUsers }}
       {{- end }}
       securityContext:
-        {{- toYaml $.Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" $ | nindent 8 }}
       containers:
         - name: loki-canary
           image: {{ include "loki-canary.image" $ }}
diff --git a/production/helm/loki/templates/overrides-exporter/deployment-overrides-exporter.yaml b/production/helm/loki/templates/overrides-exporter/deployment-overrides-exporter.yaml
@@ -62,7 +62,7 @@ spec:
       {{- end }}
       {{- include "loki.overridesExporterPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.overridesExporter.terminationGracePeriodSeconds }}
       containers:
         - name: overrides-exporter
diff --git a/production/helm/loki/templates/pattern-ingester/statefulset-pattern-ingester.yaml b/production/helm/loki/templates/pattern-ingester/statefulset-pattern-ingester.yaml
@@ -59,7 +59,7 @@ spec:
       {{- end }}
       {{- include "loki.patternIngesterPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.patternIngester.terminationGracePeriodSeconds }}
       {{- with .Values.patternIngester.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/querier/deployment-querier.yaml b/production/helm/loki/templates/querier/deployment-querier.yaml
@@ -61,7 +61,7 @@ spec:
       {{- end }}
       {{- include "loki.querierPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.querier.terminationGracePeriodSeconds }}
       {{- with .Values.querier.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/query-frontend/deployment-query-frontend.yaml b/production/helm/loki/templates/query-frontend/deployment-query-frontend.yaml
@@ -60,7 +60,7 @@ spec:
       {{- end }}
       {{- include "loki.queryFrontendPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.queryFrontend.terminationGracePeriodSeconds }}
       {{- with .Values.queryFrontend.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/query-scheduler/deployment-query-scheduler.yaml b/production/helm/loki/templates/query-scheduler/deployment-query-scheduler.yaml
@@ -62,7 +62,7 @@ spec:
       {{- end }}
       {{- include "loki.querySchedulerPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.queryScheduler.terminationGracePeriodSeconds }}
       {{- with .Values.queryScheduler.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/read/deployment-read.yaml b/production/helm/loki/templates/read/deployment-read.yaml
@@ -61,7 +61,7 @@ spec:
       {{- end }}
       {{- include "loki.readPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.read.terminationGracePeriodSeconds }}
       {{- if and (semverCompare ">=1.33-0" (include "loki.kubeVersion" .)) (kindIs "bool" .Values.read.hostUsers) }}
       hostUsers: {{ .Values.read.hostUsers }}
diff --git a/production/helm/loki/templates/read/statefulset-read.yaml b/production/helm/loki/templates/read/statefulset-read.yaml
@@ -70,7 +70,7 @@ spec:
       {{- end }}
       {{- include "loki.readPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.read.terminationGracePeriodSeconds }}
       {{- if and (semverCompare ">=1.33-0" (include "loki.kubeVersion" .)) (kindIs "bool" .Values.read.hostUsers) }}
       hostUsers: {{ .Values.read.hostUsers }}
diff --git a/production/helm/loki/templates/ruler/statefulset-ruler.yaml b/production/helm/loki/templates/ruler/statefulset-ruler.yaml
@@ -57,7 +57,7 @@ spec:
       {{- end }}
       {{- include "loki.rulerPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.ruler.terminationGracePeriodSeconds }}
       {{- with .Values.ruler.initContainers }}
       initContainers:
diff --git a/production/helm/loki/templates/single-binary/statefulset.yaml b/production/helm/loki/templates/single-binary/statefulset.yaml
@@ -78,7 +78,7 @@ spec:
       {{- end }}
       {{- include "loki.singleBinaryPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.singleBinary.terminationGracePeriodSeconds }}
       {{- if and (semverCompare ">=1.33-0" (include "loki.kubeVersion" .)) (kindIs "bool" .Values.singleBinary.hostUsers) }}
       hostUsers: {{ .Values.singleBinary.hostUsers }}
diff --git a/production/helm/loki/templates/table-manager/deployment-table-manager.yaml b/production/helm/loki/templates/table-manager/deployment-table-manager.yaml
@@ -45,7 +45,7 @@ spec:
       {{- end }}
       {{- include "loki.tableManagerPriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.tableManager.terminationGracePeriodSeconds }}
       {{- if and (semverCompare ">=1.33-0" (include "loki.kubeVersion" .)) (kindIs "bool" .Values.tableManager.hostUsers) }}
       hostUsers: {{ .Values.tableManager.hostUsers }}
diff --git a/production/helm/loki/templates/write/statefulset-write.yaml b/production/helm/loki/templates/write/statefulset-write.yaml
@@ -70,7 +70,7 @@ spec:
       {{- end }}
       {{- include "loki.writePriorityClassName" . | nindent 6 }}
       securityContext:
-        {{- toYaml .Values.loki.podSecurityContext | nindent 8 }}
+        {{- include "loki.podSecurityContext" . | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.write.terminationGracePeriodSeconds }}
       {{- if and (semverCompare ">=1.33-0" (include "loki.kubeVersion" .)) (kindIs "bool" .Values.write.hostUsers) }}
       hostUsers: {{ .Values.write.hostUsers }}
diff --git a/production/helm/loki/values.yaml b/production/helm/loki/values.yaml
@@ -106,6 +106,7 @@ loki:
   # -- The SecurityContext for Loki pods
   podSecurityContext:
     fsGroup: 10001
+    fsGroupChangePolicy: OnRootMismatch
     runAsGroup: 10001
     runAsNonRoot: true
     runAsUser: 10001

Original file line number	Diff line number	Diff line change
`@@ -7087,6 +7087,7 @@ null`
`7087`	`7087`	`<td><pre lang="json">`
`7088`	`7088`	`{`
`7089`	`7089`	`"fsGroup": 10001,`
	`7090`	`+ "fsGroupChangePolicy": "OnRootMismatch",`
`7090`	`7091`	`"runAsGroup": 10001,`
`7091`	`7092`	`"runAsNonRoot": true,`
`7092`	`7093`	`"runAsUser": 10001`
Original file line number	Diff line number	Diff line change
`@@ -13,6 +13,7 @@ Entries should include a reference to the pull request that introduced the chang`
`13`	`13`
`14`	`14`	`## Unreleased`
`15`	`15`
	`16`	`+- [ENHANCEMENT] Use fsGroupChangePolicy=OnRootMismatch on loki to speed up pod starts [#13942](https://github.com/grafana/loki/pull/13942)`
`16`	`17`
`17`	`18`	`## 6.46.0`
`18`	`19`