<p>I'm creating a pod through the <code>KubernetesPodOperator</code> in Airflow. This pod should mount a Google Cloud Storage to <code>/mnt/bucket</code> using <code>gcsfuse</code>. For this, the pod is required to be started with the <code>securityContext</code> parameter, such that it can become 'privileged'.</p>

<p>It is <a href="https://stackoverflow.com/questions/52742455/airflow-kubernetespodoperator-pass-securitycontext-parameter">currently not possible</a> to pass the securityContext parameter through Airflow. Is there another way to work around this? Perhaps by setting a 'default' securityContext before the pods are even started? I've looked at creating a <code>PodSecurityPolicy</code>, but haven't managed to figure out a way.</p>

<p>A mutating admission controller would allow you to do that: <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#mutatingadmissionwebhook" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#mutatingadmissionwebhook</a></p>

<p>The ibm-cloud team has a post about it, but I've never tried writing one: <a href="https://medium.com/ibm-cloud/diving-into-kubernetes-mutatingadmissionwebhook-6ef3c5695f74" rel="nofollow noreferrer">https://medium.com/ibm-cloud/diving-into-kubernetes-mutatingadmissionwebhook-6ef3c5695f74</a> and the folks at GiantSwarm have an end-to-end example using their Grumpy admission controller: <a href="https://docs.giantswarm.io/guides/creating-your-own-admission-controller/" rel="nofollow noreferrer">https://docs.giantswarm.io/guides/creating-your-own-admission-controller/</a></p>

<p>I would use the labels, or annotations, or maybe even the image, to identify Pods launched by Airflow, and then mutate only them to set the <code>securityContext:</code> on the Pods to be the way you want.</p>
