brought devel inline with main branch

updated installers to drop all capabilities

[sc-14936]

Author: ValClarkson

helm/install/templates/manager-upgrade.yaml

@@ -36,5 +36,6 @@ spec:
         {{- include "install.relatedImages" . | indent 8 }}
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities: { drop: [ALL] }
           readOnlyRootFilesystem: true
           runAsNonRoot: true

helm/install/templates/manager.yaml

@@ -42,5 +42,6 @@ spec:
         {{- end }}
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities: { drop: [ALL] }
           readOnlyRootFilesystem: true
           runAsNonRoot: true

helm/postgres/templates/postgres.yaml

@@ -145,7 +145,7 @@ spec:
 {{ toYaml .Values.service | indent 4 }}
   {{- end }}
   {{- if .Values.dataSource }}
-  service:
+  dataSource:
 {{ toYaml .Values.dataSource | indent 4 }}
   {{- end }}
   {{- if .Values.databaseInitSQL }}

kustomize/certmanager/postgres/postgres.yaml

@@ -3,7 +3,7 @@ kind: PostgresCluster
 metadata:
   name: hippo
 spec:
-  image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi8-4-0
+  image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi8-14.4-0
   postgresVersion: 14
   customReplicationTLSSecret:
     name: hippo-repl-tls

kustomize/install/manager/manager-upgrade.yaml

@@ -30,6 +30,7 @@ spec:
           value: "registry.developers.crunchydata.com/crunchydata/crunchy-upgrade:ubi8-5.1.2-0"
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities: { drop: [ALL] }
           readOnlyRootFilesystem: true
           runAsNonRoot: true
       serviceAccountName: postgres-operator-upgrade

kustomize/install/manager/manager.yaml

@@ -48,6 +48,7 @@ spec:
           value: "registry.developers.crunchydata.com/crunchydata/crunchy-postgres-exporter:ubi8-5.1.2-0"
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities: { drop: [ALL] }
           readOnlyRootFilesystem: true
           runAsNonRoot: true
       serviceAccountName: pgo