Add runAsNonRoot override for images that require root

catalog/types.go

@@ -69,6 +69,7 @@ type KubernetesExtensions struct {
 	DefaultPort         int32          `json:"defaultPort,omitempty"`
 	NeedsServiceAccount bool           `json:"needsServiceAccount,omitempty"`
 	ServiceAccountHint  string         `json:"serviceAccountHint,omitempty"`
+	RunAsRoot           bool           `json:"runAsRoot,omitempty"`
 	ConfigMaps          []ConfigMap    `json:"configMaps,omitempty"`
 	SecretMounts        []SecretMount  `json:"secretMounts,omitempty"`
 	CRTemplate          map[string]any `json:"crTemplate,omitempty"`
@@ -80,6 +81,7 @@ type ConfigMap struct {
 	Description    string `json:"description,omitempty"`
 	DefaultContent string `json:"defaultContent,omitempty"`
 	FileName       string `json:"fileName,omitempty"`
+	MountPath      string `json:"mountPath,omitempty"`
 	IsRequired     bool   `json:"isRequired,omitempty"`
 }
 

catalog/types_test.go

@@ -75,7 +75,14 @@ func TestIsOneClick(t *testing.T) {
 				Name: "test",
 				Meta: &Meta{
 					K8s: &KubernetesExtensions{
-						CRTemplate: map[string]any{"image": "test:latest"},
+						CRTemplate: map[string]any{
+						"source": map[string]any{
+							"type": "ContainerImage",
+							"containerImage": map[string]any{
+								"ref": "test:latest",
+							},
+						},
+					},
 					},
 				},
 			},

deploy/catalog/ansible-mcp.yaml

@@ -32,5 +32,5 @@ data:
           }
         ]
       }],
-      "_meta": { "io.openshift/k8s": { "defaultPort": 3000 } }
+      "_meta": { "io.openshift/k8s": { "defaultPort": 3000, "runAsRoot": true } }
     }

deploy/catalog/everything-mcp.yaml

@@ -20,8 +20,16 @@ data:
       "_meta": { "io.openshift/k8s": {
         "defaultPort": 3001,
         "crTemplate": {
-          "image": "quay.io/matzew/mcp-everything:latest",
-          "port": 3001
+          "source": {
+            "type": "ContainerImage",
+            "containerImage": {
+              "ref": "quay.io/matzew/mcp-everything:latest"
+            }
+          },
+          "config": {
+            "port": 3001,
+            "path": "/mcp"
+          }
         }
       } }
     }

deploy/catalog/insights-mcp.yaml

@@ -37,5 +37,5 @@ data:
           }
         ]
       }],
-      "_meta": { "io.openshift/k8s": { "defaultPort": 8000 } }
+      "_meta": { "io.openshift/k8s": { "defaultPort": 8000, "runAsRoot": true } }
     }

deploy/catalog/kubernetes-mcp.yaml

@@ -58,14 +58,27 @@ data:
             "label": "Server Configuration (config.toml)",
             "description": "TOML config file mounted at /etc/mcp-config/config.toml",
             "defaultContent": "# Kubernetes MCP Server Configuration\nlog_level = 5\nport = \"8080\"\nread_only = true\ntoolsets = [\"core\", \"config\"]\n",
-            "fileName": "config.toml"
+            "fileName": "config.toml",
+            "mountPath": "/etc/mcp-config"
           }
         ],
         "crTemplate": {
-          "image": "quay.io/containers/kubernetes_mcp_server:latest",
-          "port": 8080,
-          "args": ["--config", "/etc/mcp-config/config.toml"],
-          "serviceAccountName": "mcp-viewer"
+          "source": {
+            "type": "ContainerImage",
+            "containerImage": {
+              "ref": "quay.io/containers/kubernetes_mcp_server:latest"
+            }
+          },
+          "config": {
+            "port": 8080,
+            "path": "/mcp",
+            "arguments": ["--config", "/etc/mcp-config/config.toml"]
+          },
+          "runtime": {
+            "security": {
+              "serviceAccountName": "mcp-viewer"
+            }
+          }
         }
       } }
     }

deploy/catalog/satellite-mcp.yaml

@@ -28,6 +28,7 @@ data:
       }],
       "_meta": { "io.openshift/k8s": {
         "defaultPort": 8080,
+        "runAsRoot": true,
         "secretMounts": [
           {
             "secretKey": "ca.pem",