Remove kolla entrypoint pattern, harden SecurityContext

api/go.mod

@@ -5,7 +5,7 @@ go 1.26.3
 require (
 	github.com/onsi/gomega v1.42.1
 	github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260803113523-879ab83a55ce
-	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260806140515-16161b7b6b53
+	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260813160234-fdcb3ee3699d
 	github.com/rhobs/observability-operator v1.0.0
 	k8s.io/api v0.33.13
 	k8s.io/apimachinery v0.33.13

api/go.sum

@@ -78,8 +78,8 @@ github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
 github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260803113523-879ab83a55ce h1:XLbNNe5V6mxfJF+ETXlwgOuMAwVpidXNyBU5HD35AAQ=
 github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260803113523-879ab83a55ce/go.mod h1:XCImRHgk9LhAWyGEYihqOPubYCNwosqe/toIylOaFAc=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260806140515-16161b7b6b53 h1:9YpUAOFXCC94SwoWBRrhFyCVbbwnHTce6/j3CqjxaGM=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260806140515-16161b7b6b53/go.mod h1:LY+Q6ms3A6E8DAKCpmvQaUxO5O2CKYm0XMcmTZ6PCcM=
+github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260813160234-fdcb3ee3699d h1:+DIuFNo6jIF0/9bHYz3C6OnnMQIe3C5bbFv2bAJLLo8=
+github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260813160234-fdcb3ee3699d/go.mod h1:LY+Q6ms3A6E8DAKCpmvQaUxO5O2CKYm0XMcmTZ6PCcM=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

api/v1beta1/cloudkitty_types.go

@@ -26,12 +26,6 @@ import (
 )
 
 const (
-	// CloudKittyUserID - Kolla's cloudkitty UID comes from the 'cloudkitty-user' in
-	// https://github.com/openstack/kolla/blob/master/kolla/common/users.py
-	CloudKittyUserID = 42408
-	// CloudKittyGroupID - Kolla's cloudkitty GID
-	CloudKittyGroupID = 42408
-
 	// CloudKittyAPIContainerImage - default fall-back image for CloudKitty API
 	CloudKittyAPIContainerImage = "quay.rdoproject.org/podified-master-centos10/openstack-cloudkitty-api:current"
 	// CloudKittyProcContainerImage - default fall-back image for CloudKitty Processor

config/rbac/role.yaml

@@ -324,8 +324,7 @@ rules:
 - apiGroups:
   - security.openshift.io
   resourceNames:
-  - anyuid
-  - privileged
+  - nonroot-v2
   resources:
   - securitycontextconstraints
   verbs:

go.mod

@@ -15,7 +15,8 @@ require (
 	github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260805073337-c70c88f59cab
 	github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260806140515-16161b7b6b53
 	github.com/openstack-k8s-operators/lib-common/modules/certmanager v0.6.1-0.20260806140515-16161b7b6b53
-	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260806140515-16161b7b6b53
+	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260813160234-fdcb3ee3699d
+	github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20260813160234-fdcb3ee3699d
 	github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260803090920-52e0ba098701
 	github.com/openstack-k8s-operators/ovn-operator/api v0.6.1-0.20260806101626-af8d24ac578b
 	github.com/openstack-k8s-operators/telemetry-operator/api v0.0.0-00010101000000-000000000000
@@ -62,8 +63,8 @@ require (
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/openshift/api v3.9.0+incompatible // indirect
-	github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260725150835-623a52fe0391 // indirect
-	github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260725150835-623a52fe0391 // indirect
+	github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260813160234-fdcb3ee3699d // indirect
+	github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260813160234-fdcb3ee3699d // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/prometheus/client_golang v1.22.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect

go.sum

@@ -117,12 +117,14 @@ github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.202608061
 github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260806140515-16161b7b6b53/go.mod h1:TkZgZE92VUKHHNKXwuV8b7tT9toaxsZkcGffRafKCSA=
 github.com/openstack-k8s-operators/lib-common/modules/certmanager v0.6.1-0.20260806140515-16161b7b6b53 h1:nyN+1pyCXOr+b6D6r4WdoJlrel7kRS4gKY/JYdY2Wdo=
 github.com/openstack-k8s-operators/lib-common/modules/certmanager v0.6.1-0.20260806140515-16161b7b6b53/go.mod h1:FH/zwNFlfKkJaw4lpLa2gkUtxKT9lp38vO6Lg11AiTU=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260806140515-16161b7b6b53 h1:9YpUAOFXCC94SwoWBRrhFyCVbbwnHTce6/j3CqjxaGM=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260806140515-16161b7b6b53/go.mod h1:LY+Q6ms3A6E8DAKCpmvQaUxO5O2CKYm0XMcmTZ6PCcM=
-github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260725150835-623a52fe0391 h1:cRyVdm28fshWzWkE5xgRYAzlNX4SreIluOL8s2dpm2U=
-github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260725150835-623a52fe0391/go.mod h1:Q5wcK4PnlDJ55H+M38CFNLzL53OHYiwq81mR/gKtJXs=
-github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260725150835-623a52fe0391 h1:AJEo8hauBmqrT9v//s2S5LbEb5BDKa8cQNFG5lAznXI=
-github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260725150835-623a52fe0391/go.mod h1:fJ9CCRKpo8mQODfv4UDJ3tjUTbyCznYslXQwCkDaGg0=
+github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260813160234-fdcb3ee3699d h1:+DIuFNo6jIF0/9bHYz3C6OnnMQIe3C5bbFv2bAJLLo8=
+github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260813160234-fdcb3ee3699d/go.mod h1:LY+Q6ms3A6E8DAKCpmvQaUxO5O2CKYm0XMcmTZ6PCcM=
+github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260813160234-fdcb3ee3699d h1:btd0N5D9BwZPfXmUCcN5hPPi/v2RlIjsaNwZkbLdtx4=
+github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260813160234-fdcb3ee3699d/go.mod h1:Q5wcK4PnlDJ55H+M38CFNLzL53OHYiwq81mR/gKtJXs=
+github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260813160234-fdcb3ee3699d h1:/FKQGhZ7sE0yXfK1hjmLGhDU18t5Ew3Ex3iUh8ZR81Y=
+github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260813160234-fdcb3ee3699d/go.mod h1:fJ9CCRKpo8mQODfv4UDJ3tjUTbyCznYslXQwCkDaGg0=
+github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20260813160234-fdcb3ee3699d h1:Tj/j5+ihxeQgfn0j7i65/U1NMPwNoZOEVdG3ZcTprn0=
+github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20260813160234-fdcb3ee3699d/go.mod h1:jmVVRfwuFQ3fHLIOAkUrtLgOwEL6j45POzS3PBJuwyM=
 github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260803090920-52e0ba098701 h1:rYJayTvo7sE3F1NsjLqbRzd/F9RjymfpCGvqYZrj/q8=
 github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260803090920-52e0ba098701/go.mod h1:e/G0+fuofGEMmE1v6RWNVn9cImJosyQriG3j4NABZwQ=
 github.com/openstack-k8s-operators/ovn-operator/api v0.6.1-0.20260806101626-af8d24ac578b h1:F2VJiWumzHrI2+BuqbJJUo8/+5za+hJxLR14/Z7PCsU=

internal/autoscaling/aodh_statefulset.go

@@ -22,9 +22,11 @@ import (
 
 	"github.com/openstack-k8s-operators/lib-common/modules/common/annotations"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/env"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/pod"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/service"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/util"
+	"github.com/openstack-k8s-operators/lib-common/modules/users"
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -37,37 +39,28 @@ import (
 	telemetryv1 "github.com/openstack-k8s-operators/telemetry-operator/api/v1beta1"
 )
 
-const (
-	// ServiceCommand -
-	ServiceCommand = "/usr/local/bin/kolla_start"
-)
-
 // AodhStatefulSet func
 func AodhStatefulSet(
 	instance *telemetryv1.Autoscaling,
 	configHash string,
 	labels map[string]string,
 	topology *topologyv1.Topology,
 	memcached *memcachedv1.Memcached,
+	customConfigKeys []string,
 ) (*appsv1.StatefulSet, error) {
-	aodhUser := int64(AodhUserID)
 
+	// TODO might need tuning
 	livenessProbe := &corev1.Probe{
-		// TODO might need tuning
 		TimeoutSeconds:      30,
 		PeriodSeconds:       30,
 		InitialDelaySeconds: 5,
 	}
 	readinessProbe := &corev1.Probe{
-		// TODO might need tuning
 		TimeoutSeconds:      30,
 		PeriodSeconds:       30,
 		InitialDelaySeconds: 5,
 	}
 
-	args := []string{"-c"}
-	args = append(args, ServiceCommand)
-
 	livenessProbe.HTTPGet = &corev1.HTTPGetAction{
 		Path: "/",
 		Port: intstr.IntOrString{Type: intstr.Int, IntVal: int32(AodhAPIPort)},
@@ -84,10 +77,10 @@ func AodhStatefulSet(
 
 	// create Volume and VolumeMounts
 	volumes := getVolumes(instance)
-	apiVolumeMounts := getVolumeMounts(instance, "aodh-api")
-	evaluatorVolumeMounts := getVolumeMounts(instance, "aodh-evaluator")
-	notifierVolumeMounts := getVolumeMounts(instance, "aodh-notifier")
-	listenerVolumeMounts := getVolumeMounts(instance, "aodh-listener")
+	apiVolumeMounts := getAPIVolumeMounts(customConfigKeys)
+	evaluatorVolumeMounts := getEvaluatorVolumeMounts(customConfigKeys)
+	notifierVolumeMounts := getWorkerVolumeMounts(customConfigKeys)
+	listenerVolumeMounts := getWorkerVolumeMounts(customConfigKeys)
 
 	// add openstack CA cert if defined
 	if instance.Spec.Aodh.TLS.CaBundleSecretName != "" {
@@ -108,6 +101,9 @@ func AodhStatefulSet(
 	if memcached.GetMemcachedMTLSSecret() != "" {
 		volumes = append(volumes, memcached.CreateMTLSVolume())
 		apiVolumeMounts = append(apiVolumeMounts, memcached.CreateMTLSVolumeMounts(nil, nil)...)
+		evaluatorVolumeMounts = append(evaluatorVolumeMounts, memcached.CreateMTLSVolumeMounts(nil, nil)...)
+		notifierVolumeMounts = append(notifierVolumeMounts, memcached.CreateMTLSVolumeMounts(nil, nil)...)
+		listenerVolumeMounts = append(listenerVolumeMounts, memcached.CreateMTLSVolumeMounts(nil, nil)...)
 	}
 
 	for _, endpt := range []service.Endpoint{service.EndpointInternal, service.EndpointPublic} {
@@ -124,91 +120,90 @@ func AodhStatefulSet(
 			if err != nil {
 				return nil, err
 			}
+			certMount := fmt.Sprintf("/etc/pki/tls/certs/%s.crt", endpt.String())
+			keyMount := fmt.Sprintf("/etc/pki/tls/private/%s.key", endpt.String())
+			svc.CertMount = &certMount
+			svc.KeyMount = &keyMount
 			volumes = append(volumes, svc.CreateVolume(endpt.String()))
 			apiVolumeMounts = append(apiVolumeMounts, svc.CreateVolumeMounts(endpt.String())...)
 		}
 	}
 
 	envVarsAodh := map[string]env.Setter{}
-	envVarsAodh["KOLLA_CONFIG_STRATEGY"] = env.SetValue("COPY_ALWAYS")
 	envVarsAodh["CONFIG_HASH"] = env.SetValue(configHash)
 
 	var replicas int32 = 1
 
 	apiContainer := corev1.Container{
 		ImagePullPolicy: corev1.PullIfNotPresent,
-		Command: []string{
-			"/bin/bash",
-		},
-		Args:         args,
-		Image:        instance.Spec.Aodh.APIImage,
-		Name:         "aodh-api",
-		Env:          env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
-		VolumeMounts: apiVolumeMounts,
+		Command:         []string{"/usr/sbin/httpd"},
+		Args:            []string{"-DFOREGROUND"},
+		Image:           instance.Spec.Aodh.APIImage,
+		Name:            "aodh-api",
+		SecurityContext: pod.RestrictiveSecurityContext(users.AodhUID, users.AodhGID),
+		Env:             env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
+		VolumeMounts:    apiVolumeMounts,
+		ReadinessProbe:  readinessProbe,
+		LivenessProbe:   livenessProbe,
 	}
 
 	evaluatorContainer := corev1.Container{
 		ImagePullPolicy: corev1.PullIfNotPresent,
-		Command: []string{
-			"/bin/bash",
-		},
-		Args:         args,
-		Image:        instance.Spec.Aodh.EvaluatorImage,
-		Name:         "aodh-evaluator",
-		Env:          env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
-		VolumeMounts: evaluatorVolumeMounts,
+		Command:         []string{"/usr/bin/aodh-evaluator"},
+		Args:            []string{"--logfile", "/dev/stdout"},
+		Image:           instance.Spec.Aodh.EvaluatorImage,
+		Name:            "aodh-evaluator",
+		SecurityContext: pod.RestrictiveSecurityContext(users.AodhUID, users.AodhGID),
+		Env:             env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
+		VolumeMounts:    evaluatorVolumeMounts,
 	}
 
 	notifierContainer := corev1.Container{
 		ImagePullPolicy: corev1.PullIfNotPresent,
-		Command: []string{
-			"/bin/bash",
-		},
-		Args:         args,
-		Image:        instance.Spec.Aodh.NotifierImage,
-		Name:         "aodh-notifier",
-		Env:          env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
-		VolumeMounts: notifierVolumeMounts,
+		Command:         []string{"/usr/bin/aodh-notifier"},
+		Args:            []string{"--logfile", "/dev/stdout"},
+		Image:           instance.Spec.Aodh.NotifierImage,
+		Name:            "aodh-notifier",
+		SecurityContext: pod.RestrictiveSecurityContext(users.AodhUID, users.AodhGID),
+		Env:             env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
+		VolumeMounts:    notifierVolumeMounts,
 	}
 
 	listenerContainer := corev1.Container{
 		ImagePullPolicy: corev1.PullIfNotPresent,
-		Command: []string{
-			"/bin/bash",
-		},
-		Args:         args,
-		Image:        instance.Spec.Aodh.ListenerImage,
-		Name:         "aodh-listener",
-		Env:          env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
-		VolumeMounts: listenerVolumeMounts,
+		Command:         []string{"/usr/bin/aodh-listener"},
+		Args:            []string{"--logfile", "/dev/stdout"},
+		Image:           instance.Spec.Aodh.ListenerImage,
+		Name:            "aodh-listener",
+		SecurityContext: pod.RestrictiveSecurityContext(users.AodhUID, users.AodhGID),
+		Env:             env.MergeEnvs([]corev1.EnvVar{}, envVarsAodh),
+		VolumeMounts:    listenerVolumeMounts,
 	}
 
-	pod := corev1.PodTemplateSpec{
+	podSpec := corev1.PodTemplateSpec{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      ServiceName,
 			Namespace: instance.Namespace,
 			Labels:    labels,
 		},
 		Spec: corev1.PodSpec{
-			ServiceAccountName: instance.RbacResourceName(),
+			ServiceAccountName:           instance.RbacResourceName(),
+			AutomountServiceAccountToken: ptr.To(false),
+			SecurityContext:              pod.RestrictivePodSecurityContext(users.AodhUID, users.AodhGID, users.ApacheGID),
 			Containers: []corev1.Container{
 				apiContainer,
 				evaluatorContainer,
 				notifierContainer,
 				listenerContainer,
 			},
-			SecurityContext: &corev1.PodSecurityContext{
-				RunAsUser:    &aodhUser,
-				RunAsNonRoot: ptr.To(true),
-			},
 		},
 	}
 
 	if instance.Spec.Aodh.NodeSelector != nil {
-		pod.Spec.NodeSelector = *instance.Spec.Aodh.NodeSelector
+		podSpec.Spec.NodeSelector = *instance.Spec.Aodh.NodeSelector
 	}
 	if topology != nil {
-		topology.ApplyTo(&pod)
+		topology.ApplyTo(&podSpec)
 	}
 
 	statefulset := &appsv1.StatefulSet{
@@ -223,7 +218,7 @@ func AodhStatefulSet(
 			Selector: &metav1.LabelSelector{
 				MatchLabels: labels,
 			},
-			Template: pod,
+			Template: podSpec,
 		},
 	}
 

internal/autoscaling/const.go

@@ -47,9 +47,6 @@ const (
 
 	// ACConsumerFinalizer is added to AC secrets that autoscaling (Aodh) is actively consuming
 	ACConsumerFinalizer = "openstack.org/autoscaling-ac-consumer"
-
-	// AodhUserID -
-	AodhUserID = 42402
 )
 
 // PrometheusReplicas -

internal/autoscaling/dbsync.go

@@ -18,35 +18,27 @@ package autoscaling
 
 import (
 	"github.com/openstack-k8s-operators/lib-common/modules/common/env"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/pod"
+	"github.com/openstack-k8s-operators/lib-common/modules/users"
 	autoscalingv1beta1 "github.com/openstack-k8s-operators/telemetry-operator/api/v1beta1"
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
 )
 
-const (
-	dbSyncCommand = "/usr/local/bin/kolla_start"
-)
-
 // DbSyncJob func
-func DbSyncJob(instance *autoscalingv1beta1.Autoscaling, labels map[string]string) *batchv1.Job {
-	args := []string{"-c"}
-	args = append(args, dbSyncCommand)
-
+func DbSyncJob(instance *autoscalingv1beta1.Autoscaling, labels map[string]string, customConfigKeys []string) *batchv1.Job {
 	// create Volume and VolumeMounts
 	volumes := getVolumes(instance)
-	volumeMounts := getVolumeMounts(instance, "aodh-dbsync")
+	volumeMounts := getWorkerVolumeMounts(customConfigKeys)
 	// add CA cert if defined
 	if instance.Spec.Aodh.TLS.CaBundleSecretName != "" {
 		volumes = append(volumes, instance.Spec.Aodh.TLS.CreateVolume())
 		volumeMounts = append(volumeMounts, instance.Spec.Aodh.TLS.CreateVolumeMounts(nil)...)
 	}
 
-	runAsUser := int64(AodhUserID)
 	envVars := map[string]env.Setter{}
-	envVars["KOLLA_CONFIG_STRATEGY"] = env.SetValue("COPY_ALWAYS")
-	envVars["KOLLA_BOOTSTRAP"] = env.SetValue("TRUE")
 	aodhPassword := []corev1.EnvVar{
 		{
 			Name: "AodhPassword",
@@ -70,22 +62,18 @@ func DbSyncJob(instance *autoscalingv1beta1.Autoscaling, labels map[string]strin
 		Spec: batchv1.JobSpec{
 			Template: corev1.PodTemplateSpec{
 				Spec: corev1.PodSpec{
-					RestartPolicy:      corev1.RestartPolicyOnFailure,
-					ServiceAccountName: instance.RbacResourceName(),
+					RestartPolicy:                corev1.RestartPolicyOnFailure,
+					ServiceAccountName:           instance.RbacResourceName(),
+					AutomountServiceAccountToken: ptr.To(false),
+					SecurityContext:              pod.RestrictivePodSecurityContext(users.AodhUID, users.AodhGID),
 					Containers: []corev1.Container{
 						{
-							Name: ServiceName + "-db-sync",
-							Command: []string{
-								"/bin/bash",
-							},
-							Args:  args,
-							Image: instance.Spec.Aodh.APIImage,
-							SecurityContext: &corev1.SecurityContext{
-								RunAsUser:    &runAsUser,
-								RunAsNonRoot: ptr.To(true),
-							},
-							Env:          env.MergeEnvs(aodhPassword, envVars),
-							VolumeMounts: volumeMounts,
+							Name:            ServiceName + "-db-sync",
+							Command:         []string{"/usr/bin/aodh-dbsync"},
+							Image:           instance.Spec.Aodh.APIImage,
+							SecurityContext: pod.RestrictiveSecurityContext(users.AodhUID, users.AodhGID),
+							Env:             env.MergeEnvs(aodhPassword, envVars),
+							VolumeMounts:    volumeMounts,
 						},
 					},
 					Volumes: volumes,