From 8e27a9958a52b8d6a818e1d6695b7fdb6af17a71 Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Tue, 28 Apr 2026 13:17:14 +0200
Subject: [PATCH 01/12] feat!: Add
 `PodSecurityContextBuilder::with_stackable_defaults`

---
 crates/stackable-operator/CHANGELOG.md        |  7 ++++
 .../src/builder/pod/security.rs               | 42 +++++++++++++++----
 2 files changed, 42 insertions(+), 7 deletions(-)

diff --git a/crates/stackable-operator/CHANGELOG.md b/crates/stackable-operator/CHANGELOG.md
index 28a1071b3..5503f1a3c 100644
--- a/crates/stackable-operator/CHANGELOG.md
+++ b/crates/stackable-operator/CHANGELOG.md
@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Changed
+
+- BREAKING: `PodSecurityContextBuilder::new` was removed in favor of `PodSecurityContextBuilder::with_stackable_defaults`.
+  This function already sets up some defaults we want to use across the platform.
+- BREAKING: `PodSecurityContextBuilder::run_as_non_root` now takes a `bool` instead of assuming consumers always want to set it to `true`.
+  This is needed to allow users setting it to `false` in case the new `with_stackable_defaults` functions set's it to `true`.
+
 ## [0.111.1] - 2026-04-28
 
 ### Added
diff --git a/crates/stackable-operator/src/builder/pod/security.rs b/crates/stackable-operator/src/builder/pod/security.rs
index 6a64ebb97..675e31b9e 100644
--- a/crates/stackable-operator/src/builder/pod/security.rs
+++ b/crates/stackable-operator/src/builder/pod/security.rs
@@ -144,14 +144,42 @@ impl SecurityContextBuilder {
     }
 }
 
-#[derive(Clone, Default)]
+/// A builder to construct a [`PodSecurityContext`].
+///
+/// # Basic usage
+///
+/// ```
+/// use stackable_operator::builder::pod::security::PodSecurityContextBuilder;
+///
+/// let _ = PodSecurityContextBuilder::with_stackable_defaults()
+///     // Configure any arbitrary fields
+///     .run_as_user(1234)
+///     .build();
+/// ```
+#[derive(Clone, Debug)]
 pub struct PodSecurityContextBuilder {
     pod_security_context: PodSecurityContext,
 }
 
 impl PodSecurityContextBuilder {
-    pub fn new() -> Self {
-        Self::default()
+    /// Construct a new [`PodSecurityContextBuilder`] that is pre-filled with Stackable's defaults.
+    pub fn with_stackable_defaults() -> Self {
+        Self {
+            pod_security_context: Self::stackable_default_pod_security_context(),
+        }
+    }
+
+    /// The Stackable's defaults for a [`PodSecurityContext`].
+    ///
+    /// It is recommended to use the [`PodSecurityContextBuilder::with_stackable_defaults`] instead
+    /// (if possible).
+    pub fn stackable_default_pod_security_context() -> PodSecurityContext {
+        todo!("Lars needs to define the exact settings he wants");
+
+        PodSecurityContext {
+            run_as_non_root: Some(true),
+            ..Default::default()
+        }
     }
 
     pub fn build(&self) -> PodSecurityContext {
@@ -173,8 +201,8 @@ impl PodSecurityContextBuilder {
         self
     }
 
-    pub fn run_as_non_root(&mut self) -> &mut Self {
-        self.pod_security_context.run_as_non_root = Some(true);
+    pub fn run_as_non_root(&mut self, non_root: bool) -> &mut Self {
+        self.pod_security_context.run_as_non_root = Some(non_root);
         self
     }
 
@@ -381,13 +409,13 @@ mod tests {
 
     #[test]
     fn security_context_builder() {
-        let mut builder = PodSecurityContextBuilder::new();
+        let mut builder = PodSecurityContextBuilder::with_stackable_defaults();
         let context = builder
             .fs_group(1000)
             .fs_group_change_policy("policy")
             .run_as_user(1001)
             .run_as_group(1001)
-            .run_as_non_root()
+            .run_as_non_root(true)
             .supplemental_groups(&[1002, 1003])
             .se_linux_level("level")
             .se_linux_role("role")

From a193ef1f042de85b95e044e2fe78cd44ced30b57 Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Thu, 25 Jun 2026 11:33:03 +0200
Subject: [PATCH 02/12] We decided on only runAsNonRoot for now

---
 crates/stackable-operator/CHANGELOG.md                | 1 +
 crates/stackable-operator/src/builder/pod/security.rs | 8 +++++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/crates/stackable-operator/CHANGELOG.md b/crates/stackable-operator/CHANGELOG.md
index c73febf4f..844c0d2c8 100644
--- a/crates/stackable-operator/CHANGELOG.md
+++ b/crates/stackable-operator/CHANGELOG.md
@@ -8,6 +8,7 @@ All notable changes to this project will be documented in this file.
 
 - BREAKING: `PodSecurityContextBuilder::new` was removed in favor of `PodSecurityContextBuilder::with_stackable_defaults` ([#XXXX]).
   This function already sets up some defaults we want to use across the platform.
+  Currently this is `runAsNonRoot: true`, which might cause product Pods to crash and require changes.
 - BREAKING: `PodSecurityContextBuilder::run_as_non_root` now takes a `bool` instead of assuming consumers always want to set it to `true` ([#XXXX]).
   This is needed to allow users setting it to `false` in case the new `with_stackable_defaults` functions set's it to `true`.
 
diff --git a/crates/stackable-operator/src/builder/pod/security.rs b/crates/stackable-operator/src/builder/pod/security.rs
index 675e31b9e..b6e3121de 100644
--- a/crates/stackable-operator/src/builder/pod/security.rs
+++ b/crates/stackable-operator/src/builder/pod/security.rs
@@ -163,6 +163,10 @@ pub struct PodSecurityContextBuilder {
 
 impl PodSecurityContextBuilder {
     /// Construct a new [`PodSecurityContextBuilder`] that is pre-filled with Stackable's defaults.
+    ///
+    /// Currently the defaults are:
+    ///
+    /// * `runAsNonRoot: true`
     pub fn with_stackable_defaults() -> Self {
         Self {
             pod_security_context: Self::stackable_default_pod_security_context(),
@@ -172,10 +176,8 @@ impl PodSecurityContextBuilder {
     /// The Stackable's defaults for a [`PodSecurityContext`].
     ///
     /// It is recommended to use the [`PodSecurityContextBuilder::with_stackable_defaults`] instead
-    /// (if possible).
+    /// (if possible). Have a look at it's documentation for details.
     pub fn stackable_default_pod_security_context() -> PodSecurityContext {
-        todo!("Lars needs to define the exact settings he wants");
-
         PodSecurityContext {
             run_as_non_root: Some(true),
             ..Default::default()

From abbc85c2d6652f09592eed077a86bcef73f26817 Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Thu, 25 Jun 2026 11:35:04 +0200
Subject: [PATCH 03/12] Remove stackable_default_pod_security_context fn

---
 .../src/builder/pod/security.rs                  | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/crates/stackable-operator/src/builder/pod/security.rs b/crates/stackable-operator/src/builder/pod/security.rs
index b6e3121de..5b6927600 100644
--- a/crates/stackable-operator/src/builder/pod/security.rs
+++ b/crates/stackable-operator/src/builder/pod/security.rs
@@ -169,18 +169,10 @@ impl PodSecurityContextBuilder {
     /// * `runAsNonRoot: true`
     pub fn with_stackable_defaults() -> Self {
         Self {
-            pod_security_context: Self::stackable_default_pod_security_context(),
-        }
-    }
-
-    /// The Stackable's defaults for a [`PodSecurityContext`].
-    ///
-    /// It is recommended to use the [`PodSecurityContextBuilder::with_stackable_defaults`] instead
-    /// (if possible). Have a look at it's documentation for details.
-    pub fn stackable_default_pod_security_context() -> PodSecurityContext {
-        PodSecurityContext {
-            run_as_non_root: Some(true),
-            ..Default::default()
+            pod_security_context: PodSecurityContext {
+                run_as_non_root: Some(true),
+                ..Default::default()
+            },
         }
     }
 

From c6e34bc99a47d2008e8a579241ce334421c4a355 Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Thu, 25 Jun 2026 11:40:54 +0200
Subject: [PATCH 04/12] Use builder functions to ensure we can override

---
 .../src/builder/pod/security.rs                   | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/crates/stackable-operator/src/builder/pod/security.rs b/crates/stackable-operator/src/builder/pod/security.rs
index 5b6927600..b44f1f6a7 100644
--- a/crates/stackable-operator/src/builder/pod/security.rs
+++ b/crates/stackable-operator/src/builder/pod/security.rs
@@ -168,12 +168,15 @@ impl PodSecurityContextBuilder {
     ///
     /// * `runAsNonRoot: true`
     pub fn with_stackable_defaults() -> Self {
-        Self {
-            pod_security_context: PodSecurityContext {
-                run_as_non_root: Some(true),
-                ..Default::default()
-            },
-        }
+        // We are using the builder functions to ensure that builder functions exist to override these settings.
+        let mut builder = Self {
+            pod_security_context: PodSecurityContext::default(),
+        };
+
+        // Reason: Running as root is bad
+        builder.run_as_non_root(true);
+
+        builder
     }
 
     pub fn build(&self) -> PodSecurityContext {

From 77291e73e060ad3e4ea76a783c9cf05f9f6721da Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Thu, 25 Jun 2026 12:25:39 +0200
Subject: [PATCH 05/12] Do the same thing for SecurityContextBuilder

---
 crates/stackable-operator/CHANGELOG.md        |  7 +++--
 .../src/builder/pod/security.rs               | 29 ++++++++++++++-----
 2 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/crates/stackable-operator/CHANGELOG.md b/crates/stackable-operator/CHANGELOG.md
index 844c0d2c8..818022980 100644
--- a/crates/stackable-operator/CHANGELOG.md
+++ b/crates/stackable-operator/CHANGELOG.md
@@ -6,13 +6,14 @@ All notable changes to this project will be documented in this file.
 
 ### Changed
 
-- BREAKING: `PodSecurityContextBuilder::new` was removed in favor of `PodSecurityContextBuilder::with_stackable_defaults` ([#XXXX]).
+- BREAKING: `PodSecurityContextBuilder::new` was removed in favor of `PodSecurityContextBuilder::with_stackable_defaults`
+  (same for `SecurityContextBuilder`) ([#1205]).
   This function already sets up some defaults we want to use across the platform.
   Currently this is `runAsNonRoot: true`, which might cause product Pods to crash and require changes.
-- BREAKING: `PodSecurityContextBuilder::run_as_non_root` now takes a `bool` instead of assuming consumers always want to set it to `true` ([#XXXX]).
+- BREAKING: `PodSecurityContextBuilder::run_as_non_root` now takes a `bool` instead of assuming consumers always want to set it to `true` ([#1205]).
   This is needed to allow users setting it to `false` in case the new `with_stackable_defaults` functions set's it to `true`.
 
-[#XXXX]: https://github.com/stackabletech/operator-rs/pull/XXXX
+[#1205]: https://github.com/stackabletech/operator-rs/pull/1205
 
 ## [0.113.0] - 2026-06-22
 
diff --git a/crates/stackable-operator/src/builder/pod/security.rs b/crates/stackable-operator/src/builder/pod/security.rs
index b44f1f6a7..121ffdb87 100644
--- a/crates/stackable-operator/src/builder/pod/security.rs
+++ b/crates/stackable-operator/src/builder/pod/security.rs
@@ -10,16 +10,29 @@ pub struct SecurityContextBuilder {
 }
 
 impl SecurityContextBuilder {
-    /// Convenience function for a wide use-case.
-    pub fn run_as_root() -> SecurityContext {
-        SecurityContext {
-            run_as_user: Some(0),
-            ..SecurityContext::default()
-        }
+    /// Construct a new [`SecurityContextBuilder`] that is pre-filled with Stackable's defaults.
+    ///
+    /// Currently the defaults are:
+    ///
+    /// * `runAsNonRoot: true`
+    pub fn with_stackable_defaults() -> Self {
+        // We are using the builder functions to ensure that builder functions exist to override these settings.
+        let mut builder = Self {
+            security_context: SecurityContext::default(),
+        };
+
+        // Reason: Running as root is bad
+        builder.run_as_non_root(true);
+
+        builder
     }
 
-    pub fn new() -> Self {
-        Self::default()
+    /// Convenience function for a wide use-case.
+    ///
+    /// Please only use this is really needed.
+    pub fn run_as_root(&mut self) {
+        self.run_as_user(0);
+        self.run_as_non_root(false);
     }
 
     pub fn allow_privilege_escalation(&mut self, value: bool) -> &mut Self {

From f3ce81f349062cd51910a0bab23e7923e9a74b0b Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Thu, 25 Jun 2026 12:26:19 +0200
Subject: [PATCH 06/12] typo

---
 crates/stackable-operator/CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/stackable-operator/CHANGELOG.md b/crates/stackable-operator/CHANGELOG.md
index 818022980..1cd0b0dc0 100644
--- a/crates/stackable-operator/CHANGELOG.md
+++ b/crates/stackable-operator/CHANGELOG.md
@@ -11,7 +11,7 @@ All notable changes to this project will be documented in this file.
   This function already sets up some defaults we want to use across the platform.
   Currently this is `runAsNonRoot: true`, which might cause product Pods to crash and require changes.
 - BREAKING: `PodSecurityContextBuilder::run_as_non_root` now takes a `bool` instead of assuming consumers always want to set it to `true` ([#1205]).
-  This is needed to allow users setting it to `false` in case the new `with_stackable_defaults` functions set's it to `true`.
+  This is needed to allow users setting it to `false` in case the new `with_stackable_defaults` function sets it to `true`.
 
 [#1205]: https://github.com/stackabletech/operator-rs/pull/1205
 

From 8f8f449e388afb039e380f988a913681ce64f511 Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Thu, 25 Jun 2026 12:28:45 +0200
Subject: [PATCH 07/12] changelog

---
 crates/stackable-operator/CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/crates/stackable-operator/CHANGELOG.md b/crates/stackable-operator/CHANGELOG.md
index 1cd0b0dc0..af123aa5e 100644
--- a/crates/stackable-operator/CHANGELOG.md
+++ b/crates/stackable-operator/CHANGELOG.md
@@ -12,6 +12,7 @@ All notable changes to this project will be documented in this file.
   Currently this is `runAsNonRoot: true`, which might cause product Pods to crash and require changes.
 - BREAKING: `PodSecurityContextBuilder::run_as_non_root` now takes a `bool` instead of assuming consumers always want to set it to `true` ([#1205]).
   This is needed to allow users setting it to `false` in case the new `with_stackable_defaults` function sets it to `true`.
+- BREAKING: `SecurityContextBuilder::run_as_root` is now called on the builder, not as a builder-creation function ([#1205]).
 
 [#1205]: https://github.com/stackabletech/operator-rs/pull/1205
 

From 3bd1b694266e3644ecb93dfc57dd9af178e1d41b Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Thu, 25 Jun 2026 14:31:43 +0200
Subject: [PATCH 08/12] Remove SecurityContextBuilder::run_as_root

---
 crates/stackable-operator/CHANGELOG.md                | 2 +-
 crates/stackable-operator/src/builder/pod/security.rs | 8 --------
 2 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/crates/stackable-operator/CHANGELOG.md b/crates/stackable-operator/CHANGELOG.md
index af123aa5e..e83bc01a5 100644
--- a/crates/stackable-operator/CHANGELOG.md
+++ b/crates/stackable-operator/CHANGELOG.md
@@ -12,7 +12,7 @@ All notable changes to this project will be documented in this file.
   Currently this is `runAsNonRoot: true`, which might cause product Pods to crash and require changes.
 - BREAKING: `PodSecurityContextBuilder::run_as_non_root` now takes a `bool` instead of assuming consumers always want to set it to `true` ([#1205]).
   This is needed to allow users setting it to `false` in case the new `with_stackable_defaults` function sets it to `true`.
-- BREAKING: `SecurityContextBuilder::run_as_root` is now called on the builder, not as a builder-creation function ([#1205]).
+- BREAKING: `SecurityContextBuilder::run_as_root` has been removed ([#1205]).
 
 [#1205]: https://github.com/stackabletech/operator-rs/pull/1205
 
diff --git a/crates/stackable-operator/src/builder/pod/security.rs b/crates/stackable-operator/src/builder/pod/security.rs
index 121ffdb87..fe0ceefea 100644
--- a/crates/stackable-operator/src/builder/pod/security.rs
+++ b/crates/stackable-operator/src/builder/pod/security.rs
@@ -27,14 +27,6 @@ impl SecurityContextBuilder {
         builder
     }
 
-    /// Convenience function for a wide use-case.
-    ///
-    /// Please only use this is really needed.
-    pub fn run_as_root(&mut self) {
-        self.run_as_user(0);
-        self.run_as_non_root(false);
-    }
-
     pub fn allow_privilege_escalation(&mut self, value: bool) -> &mut Self {
         self.security_context.allow_privilege_escalation = Some(value);
         self

From 19b939e8ec0a19762e8428ed49114d31aa705db1 Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Thu, 25 Jun 2026 14:41:26 +0200
Subject: [PATCH 09/12] fix: Remove SecurityContextBuilder::default

---
 crates/stackable-operator/src/builder/pod/security.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/stackable-operator/src/builder/pod/security.rs b/crates/stackable-operator/src/builder/pod/security.rs
index fe0ceefea..f79c32c74 100644
--- a/crates/stackable-operator/src/builder/pod/security.rs
+++ b/crates/stackable-operator/src/builder/pod/security.rs
@@ -4,7 +4,7 @@ use k8s_openapi::api::core::v1::{
 };
 
 /// A builder for [`SecurityContext`] objects (not to be confused with `PodSecurityContext`).
-#[derive(Clone, Default)]
+#[derive(Clone)]
 pub struct SecurityContextBuilder {
     security_context: SecurityContext,
 }

From bee890e76dd041153d98cf70d51a832589346fb0 Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Mon, 3 Aug 2026 14:14:02 +0200
Subject: [PATCH 10/12] chore: Don't default to runAsNonRoot in
 SecurityContextBuilder

---
 crates/stackable-operator/src/builder/pod/security.rs | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/crates/stackable-operator/src/builder/pod/security.rs b/crates/stackable-operator/src/builder/pod/security.rs
index f79c32c74..b3a944fc4 100644
--- a/crates/stackable-operator/src/builder/pod/security.rs
+++ b/crates/stackable-operator/src/builder/pod/security.rs
@@ -17,12 +17,15 @@ impl SecurityContextBuilder {
     /// * `runAsNonRoot: true`
     pub fn with_stackable_defaults() -> Self {
         // We are using the builder functions to ensure that builder functions exist to override these settings.
-        let mut builder = Self {
+        let builder = Self {
             security_context: SecurityContext::default(),
         };
 
-        // Reason: Running as root is bad
-        builder.run_as_non_root(true);
+        // We currently don't have any defaults we set.
+
+        // We intentionally don't set `runAsNonRoot`, as we set that in
+        // [`PodSecurityContextBuilder::with_stackable_defaults`] already and don't want to confuse
+        // users by setting it on the Pod and container.
 
         builder
     }

From 0d9df8f89dbc24768e241e9bae0e42ac17354838 Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Mon, 3 Aug 2026 14:16:00 +0200
Subject: [PATCH 11/12] fix changelog

---
 crates/stackable-operator/CHANGELOG.md | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/crates/stackable-operator/CHANGELOG.md b/crates/stackable-operator/CHANGELOG.md
index e5648a3ee..55fe16122 100644
--- a/crates/stackable-operator/CHANGELOG.md
+++ b/crates/stackable-operator/CHANGELOG.md
@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Changed
+
+- BREAKING: `PodSecurityContextBuilder::new` was removed in favor of `PodSecurityContextBuilder::with_stackable_defaults`
+  (same for `SecurityContextBuilder`) ([#1205]).
+  This function already sets up some defaults we want to use across the platform.
+  Currently this is `runAsNonRoot: true` for `PodSecurityContextBuilder`, which might cause product Pods to crash and require changes.
+- BREAKING: `PodSecurityContextBuilder::run_as_non_root` now takes a `bool` instead of assuming consumers always want to set it to `true` ([#1205]).
+  This is needed to allow users setting it to `false` in case the new `with_stackable_defaults` function sets it to `true`.
+- BREAKING: `SecurityContextBuilder::run_as_root` has been removed ([#1205]).
+
+[#1205]: https://github.com/stackabletech/operator-rs/pull/1205
+
 ## [0.114.0] - 2026-07-22
 
 ### Added
@@ -60,17 +72,6 @@ All notable changes to this project will be documented in this file.
   in the `SecretOperatorVolumeSourceBuilder` ([#1209]).
 - Add `Role::fixed_replica_count` and `Role::estimated_replica_count` helper functions ([#1241]).
 
-### Changed
-
-- BREAKING: `PodSecurityContextBuilder::new` was removed in favor of `PodSecurityContextBuilder::with_stackable_defaults`
-  (same for `SecurityContextBuilder`) ([#1205]).
-  This function already sets up some defaults we want to use across the platform.
-  Currently this is `runAsNonRoot: true`, which might cause product Pods to crash and require changes.
-- BREAKING: `PodSecurityContextBuilder::run_as_non_root` now takes a `bool` instead of assuming consumers always want to set it to `true` ([#1205]).
-  This is needed to allow users setting it to `false` in case the new `with_stackable_defaults` function sets it to `true`.
-- BREAKING: `SecurityContextBuilder::run_as_root` has been removed ([#1205]).
-
-[#1205]: https://github.com/stackabletech/operator-rs/pull/1205
 [#1209]: https://github.com/stackabletech/operator-rs/pull/1209
 [#1241]: https://github.com/stackabletech/operator-rs/pull/1241
 

From 7dc54fc169a6f1c6e935b990beac0ccb0a9d274c Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Mon, 3 Aug 2026 14:18:17 +0200
Subject: [PATCH 12/12] Update docs

---
 .../src/builder/pod/security.rs               | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/crates/stackable-operator/src/builder/pod/security.rs b/crates/stackable-operator/src/builder/pod/security.rs
index b3a944fc4..cc3db9e24 100644
--- a/crates/stackable-operator/src/builder/pod/security.rs
+++ b/crates/stackable-operator/src/builder/pod/security.rs
@@ -12,22 +12,15 @@ pub struct SecurityContextBuilder {
 impl SecurityContextBuilder {
     /// Construct a new [`SecurityContextBuilder`] that is pre-filled with Stackable's defaults.
     ///
-    /// Currently the defaults are:
+    /// We currently don't have any defaults we set.
     ///
-    /// * `runAsNonRoot: true`
+    /// We intentionally don't set `runAsNonRoot`, as we set that in
+    /// [`PodSecurityContextBuilder::with_stackable_defaults`] already and don't want to confuse
+    /// users by setting it on the Pod and container.
     pub fn with_stackable_defaults() -> Self {
-        // We are using the builder functions to ensure that builder functions exist to override these settings.
-        let builder = Self {
+        Self {
             security_context: SecurityContext::default(),
-        };
-
-        // We currently don't have any defaults we set.
-
-        // We intentionally don't set `runAsNonRoot`, as we set that in
-        // [`PodSecurityContextBuilder::with_stackable_defaults`] already and don't want to confuse
-        // users by setting it on the Pod and container.
-
-        builder
+        }
     }
 
     pub fn allow_privilege_escalation(&mut self, value: bool) -> &mut Self {