only add sysctl when port is bellow 1024

library/common-test/tests/pod/securityContext.yaml

@@ -64,7 +64,7 @@ tests:
             securityContext:
               fsGroup: 1001
     asserts:
-      - documentIndex: &statefulSetDoc 0
+      - documentIndex: *statefulSetDoc
         isKind:
           of: StatefulSet
       - documentIndex: *statefulSetDoc
@@ -116,7 +116,7 @@ tests:
                 - name: some_other_name
                   value: "some_different_value"
     asserts:
-      - documentIndex: &statefulSetDoc 0
+      - documentIndex: *statefulSetDoc
         isKind:
           of: StatefulSet
       - documentIndex: *statefulSetDoc
@@ -187,7 +187,7 @@ tests:
               primary: true
               port: 443
     asserts:
-      - documentIndex: &statefulSetDoc 0
+      - documentIndex: *statefulSetDoc
         isKind:
           of: StatefulSet
       - documentIndex: *statefulSetDoc
@@ -224,6 +224,39 @@ tests:
               - name: net.ipv4.ping_group_range
                 value: "443 443"
 
+  - it: should pass with no sysctls port_start automatically appended based on services when port is higher than 1024
+    set:
+      workload:
+        workload-name1:
+          enabled: true
+          primary: true
+          type: Deployment
+          podSpec: {}
+      service:
+        service-name1:
+          enabled: true
+          primary: true
+          type: ClusterIP
+          ports:
+            port-name:
+              enabled: true
+              primary: true
+              port: 25000
+              targetPort: 3000
+    asserts:
+      - documentIndex: &deploymentDoc 0
+        isKind:
+          of: Deployment
+      - documentIndex: *deploymentDoc
+        equal:
+          path: spec.template.spec.securityContext
+          value:
+            fsGroup: 568
+            fsGroupChangePolicy: OnRootMismatch
+            sysctls:
+              - name: net.ipv4.ping_group_range
+                value: "3000 3000"
+
   # Failures
   - it: should fail with empty securityContext from "global"
     set:

library/common/1.0.0/templates/lib/pod/_podSecurityContext.tpl

@@ -27,7 +27,9 @@ objectData: The object data to be used to render the Pod.
     */}}
   {{- $portRange := fromJson (include "ix.v1.common.lib.pod.securityContext.getPortRange" (dict "rootCtx" $rootCtx "objectData" $objectData)) -}}
   {{- if and $portRange.low $portRange.high -}}
-    {{- $_ := set $secContext "sysctls" (mustAppend $secContext.sysctls (dict "name" "net.ipv4.ip_unprivileged_port_start" "value" (printf "%v" $portRange.low))) -}}
+    {{- if le (int $portRange.low) 1024 -}}
+      {{- $_ := set $secContext "sysctls" (mustAppend $secContext.sysctls (dict "name" "net.ipv4.ip_unprivileged_port_start" "value" (printf "%v" $portRange.low))) -}}
+    {{- end -}}
     {{- $_ := set $secContext "sysctls" (mustAppend $secContext.sysctls (dict "name" "net.ipv4.ping_group_range" "value" (printf "%v %v" $portRange.low $portRange.high))) -}}
   {{- end -}}