From de26bdbb5b71c52d6f4c1071956f112ca0d2e46d Mon Sep 17 00:00:00 2001
From: Ondra Kupka <okupka@redhat.com>
Date: Thu, 6 Nov 2025 15:27:09 +0100
Subject: [PATCH] lib/resourcemerge: Add support for hostUsers flag

When a pod spec is being ensured, hostUsers flag is not taken into
account. This is now fixed and hostUsers is copied into the resulting
pod spec.
---
 lib/resourcemerge/core.go      |  1 +
 lib/resourcemerge/core_test.go | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/lib/resourcemerge/core.go b/lib/resourcemerge/core.go
index c18a948f0..822038e5c 100644
--- a/lib/resourcemerge/core.go
+++ b/lib/resourcemerge/core.go
@@ -47,6 +47,7 @@ func ensurePodSpec(modified *bool, existing *corev1.PodSpec, required corev1.Pod
 
 	setStringIfSet(modified, &existing.ServiceAccountName, required.ServiceAccountName)
 	setBool(modified, &existing.HostNetwork, required.HostNetwork)
+	setBoolPtr(modified, &existing.HostUsers, required.HostUsers)
 	mergeMap(modified, &existing.NodeSelector, required.NodeSelector)
 	ensurePodSecurityContextPtr(modified, &existing.SecurityContext, required.SecurityContext)
 	ensureAffinityPtr(modified, &existing.Affinity, required.Affinity)
diff --git a/lib/resourcemerge/core_test.go b/lib/resourcemerge/core_test.go
index 74ea9a5c9..1ec88c09e 100644
--- a/lib/resourcemerge/core_test.go
+++ b/lib/resourcemerge/core_test.go
@@ -45,6 +45,17 @@ func TestEnsurePodSpec(t *testing.T) {
 				Containers: []corev1.Container{
 					{Name: "test"}}},
 		},
+		{
+			name:     "hostUsers flag is set",
+			existing: corev1.PodSpec{},
+			input: corev1.PodSpec{
+				HostUsers: boolPtr(false),
+			},
+			expectedModified: true,
+			expected: corev1.PodSpec{
+				HostUsers: boolPtr(false),
+			},
+		},
 		{
 			name: "PodSecurityContext empty",
 			existing: corev1.PodSpec{