stable/unifi: Add "addSetfcap" option to give the SETFCAP capability to the Unifi container (#10143)

Signed-off-by: Mike Cronce <mike@quadra-tec.net>

charts/unifi/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 appVersion: 5.9.29
 description: Ubiquiti Network's Unifi Controller
 name: unifi
-version: 0.2.2
+version: 0.2.3
 keywords:
   - ubiquiti
   - unifi

charts/unifi/README.md

@@ -75,6 +75,7 @@ The following tables lists the configurable parameters of the Sentry chart and t
 | `ingress.tls`                  | Ingress TLS configuration | `[]` |
 | `timezone`                     | Timezone the Unifi controller should run as, e.g. 'America/New York' | `UTC` |
 | `runAsRoot`                    | Run the controller as UID0 (root user) | `false` |
+| `addSetfcap`                   | Give the controller container the SETFCAP capability; this is necessary when not running as root | `true` |
 | `mongodb.enabled`              | Use external MongoDB for data storage | `false` |
 | `mongodb.dbUri`                | external MongoDB URI | `mongodb://mongo/unifi` |
 | `mongodb.statDbUri`            | external MongoDB statdb URI | `mongodb://mongo/unifi_stat` |

charts/unifi/templates/deployment.yaml

@@ -42,6 +42,12 @@ spec:
             - name: stun
               containerPort: 3478
               protocol: UDP
+          {{- if .Values.addSetfcap }}
+          securityContext:
+            capabilities:
+              add:
+                - SETFCAP
+          {{- end }}
           livenessProbe:
             httpGet:
               path: /status

charts/unifi/values.yaml

@@ -109,6 +109,7 @@ ingress:
 timezone: UTC
 
 runAsRoot: false
+addSetfcap: true
 
   # define an external mongoDB instead of using the built-in mongodb
 mongodb: