fix: nats-server runs as non-root

.github/workflows/pull-e2e-upgrade-test.yaml

@@ -8,11 +8,11 @@ env:
 
 on:
   pull_request:
-    branches: [ "main" ]
+    branches: ["main"]
     paths-ignore:
-      - 'docs/**'
-      - '**.md'
-      - 'sec-scanners-config.yaml'
+      - "docs/**"
+      - "**.md"
+      - "sec-scanners-config.yaml"
 
 jobs:
   e2e-upgrade: # This job tests the upgrade of NATS module from latest image of the main branch to the current commit.
@@ -74,6 +74,26 @@ jobs:
         run: |
           make e2e-nats-server
 
+      - name: Show all StatefulSets in Namespace kyma-system
+        if: ${{ always() }}
+        run: |
+          kubectl get sts -n kyma-system -o yaml
+
+      - name: Show all Deployments in Namespace kyma-system
+        if: ${{ always() }}
+        run: |
+          kubectl get deploy -n kyma-system -o yaml
+
+      - name: Show all Pods in Namespace kyma-system
+        if: ${{ always() }}
+        run: |
+          kubectl get po -n kyma-system -o yaml
+
+      - name: Show all ConfigMaps in Namespace kyma-system
+        if: ${{ always() }}
+        run: |
+          kubectl get cm -n kyma-system -o yaml
+
       - name: Cleanup NATS CR
         run: |
           make e2e-cleanup

resources/nats/templates/statefulset.yaml

@@ -94,6 +94,15 @@ spec:
       # reload to the server without restarting the pod.
       shareProcessNamespace: true
 
+      initContainers:
+      - name: fix-jetstream-storage
+        securityContext:
+          runAsUser: 0
+        image: alpine:latest
+        command: ["sh", "-c", "chown -R 1000:10001 {{ .Values.nats.jetstream.fileStorage.storageDirectory }} && chmod -R 755 {{ .Values.nats.jetstream.fileStorage.storageDirectory }} && echo 'Done!'"]
+        volumeMounts:
+          - name: {{ include "nats.fullname" . }}-js-pvc
+            mountPath: {{ .Values.nats.jetstream.fileStorage.storageDirectory }}
       #################
       #               #
       #  NATS Server  #

resources/nats/values.yaml

@@ -38,6 +38,7 @@ global:
 #                                  #
 ####################################
 podSecurityContext:
+  runAsUser: 1000
   fsGroup: 10001
   seccompProfile:
     type: RuntimeDefault