From e341fc391b9396c234f4712b490c237c112c3015 Mon Sep 17 00:00:00 2001
From: Stavros kois <s.kois@outlook.com>
Date: Sat, 11 Feb 2023 13:16:54 +0200
Subject: [PATCH] only add sysctl when port is bellow 1024

---
 .../tests/pod/securityContext.yaml            | 39 +++++++++++++++++--
 .../templates/lib/pod/_podSecurityContext.tpl |  4 +-
 2 files changed, 39 insertions(+), 4 deletions(-)

diff --git a/library/common-test/tests/pod/securityContext.yaml b/library/common-test/tests/pod/securityContext.yaml
index 0e0c4416c6..592201e9b5 100644
--- a/library/common-test/tests/pod/securityContext.yaml
+++ b/library/common-test/tests/pod/securityContext.yaml
@@ -64,7 +64,7 @@ tests:
             securityContext:
               fsGroup: 1001
     asserts:
-      - documentIndex: &statefulSetDoc 0
+      - documentIndex: *statefulSetDoc
         isKind:
           of: StatefulSet
       - documentIndex: *statefulSetDoc
@@ -116,7 +116,7 @@ tests:
                 - name: some_other_name
                   value: "some_different_value"
     asserts:
-      - documentIndex: &statefulSetDoc 0
+      - documentIndex: *statefulSetDoc
         isKind:
           of: StatefulSet
       - documentIndex: *statefulSetDoc
@@ -187,7 +187,7 @@ tests:
               primary: true
               port: 443
     asserts:
-      - documentIndex: &statefulSetDoc 0
+      - documentIndex: *statefulSetDoc
         isKind:
           of: StatefulSet
       - documentIndex: *statefulSetDoc
@@ -224,6 +224,39 @@ tests:
               - name: net.ipv4.ping_group_range
                 value: "443 443"
 
+  - it: should pass with no sysctls port_start automatically appended based on services when port is higher than 1024
+    set:
+      workload:
+        workload-name1:
+          enabled: true
+          primary: true
+          type: Deployment
+          podSpec: {}
+      service:
+        service-name1:
+          enabled: true
+          primary: true
+          type: ClusterIP
+          ports:
+            port-name:
+              enabled: true
+              primary: true
+              port: 25000
+              targetPort: 3000
+    asserts:
+      - documentIndex: &deploymentDoc 0
+        isKind:
+          of: Deployment
+      - documentIndex: *deploymentDoc
+        equal:
+          path: spec.template.spec.securityContext
+          value:
+            fsGroup: 568
+            fsGroupChangePolicy: OnRootMismatch
+            sysctls:
+              - name: net.ipv4.ping_group_range
+                value: "3000 3000"
+
   # Failures
   - it: should fail with empty securityContext from "global"
     set:
diff --git a/library/common/1.0.0/templates/lib/pod/_podSecurityContext.tpl b/library/common/1.0.0/templates/lib/pod/_podSecurityContext.tpl
index dad6ac4ef4..87f3a8ed4f 100644
--- a/library/common/1.0.0/templates/lib/pod/_podSecurityContext.tpl
+++ b/library/common/1.0.0/templates/lib/pod/_podSecurityContext.tpl
@@ -27,7 +27,9 @@ objectData: The object data to be used to render the Pod.
     */}}
   {{- $portRange := fromJson (include "ix.v1.common.lib.pod.securityContext.getPortRange" (dict "rootCtx" $rootCtx "objectData" $objectData)) -}}
   {{- if and $portRange.low $portRange.high -}}
-    {{- $_ := set $secContext "sysctls" (mustAppend $secContext.sysctls (dict "name" "net.ipv4.ip_unprivileged_port_start" "value" (printf "%v" $portRange.low))) -}}
+    {{- if le (int $portRange.low) 1024 -}}
+      {{- $_ := set $secContext "sysctls" (mustAppend $secContext.sysctls (dict "name" "net.ipv4.ip_unprivileged_port_start" "value" (printf "%v" $portRange.low))) -}}
+    {{- end -}}
     {{- $_ := set $secContext "sysctls" (mustAppend $secContext.sysctls (dict "name" "net.ipv4.ping_group_range" "value" (printf "%v %v" $portRange.low $portRange.high))) -}}
   {{- end -}}