feat(k8s): allow to set security contexts for worker and apps

Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>
2025-04-17 09:59:37 +02:00
parent 319c939c1f
commit 9fa02c15b1
6 changed files with 442 additions and 55 deletions
@@ -1328,6 +1328,48 @@ worker:
    tag: ""
    digest: ""

+  ## Configure Pods Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
+  ## @param worker.podSecurityContext.enabled Enable worker pods' Security Context
+  ## @param worker.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for worker pods
+  ## @param worker.podSecurityContext.sysctls Set kernel settings using the sysctl interface for worker pods
+  ## @param worker.podSecurityContext.supplementalGroups Set filesystem extra groups for worker pods
+  ## @param worker.podSecurityContext.fsGroup Set fsGroup in worker pods' Security Context
+  ##
+  podSecurityContext:
+    enabled: true
+    fsGroupChangePolicy: Always
+    sysctls: []
+    supplementalGroups: []
+    fsGroup: 1001
+    
+  ## Configure Container Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
+  ## @param worker.containerSecurityContext.enabled Enabled worker container' Security Context
+  ## @param worker.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in worker container
+  ## @param worker.containerSecurityContext.runAsUser Set runAsUser in worker container' Security Context
+  ## @param worker.containerSecurityContext.runAsGroup Set runAsGroup in worker container' Security Context
+  ## @param worker.containerSecurityContext.runAsNonRoot Set runAsNonRoot in worker container' Security Context
+  ## @param worker.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in worker container' Security Context
+  ## @param worker.containerSecurityContext.privileged Set privileged in worker container' Security Context
+  ## @param worker.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in worker container' Security Context
+  ## @param worker.containerSecurityContext.capabilities.drop List of capabilities to be dropped in worker container
+  ## @param worker.containerSecurityContext.seccompProfile.type Set seccomp profile in worker container
+  ##
+  containerSecurityContext:
+    enabled: true
+    seLinuxOptions: {}
+    runAsUser: 1001
+    runAsGroup: 1001
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    privileged: false
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+    seccompProfile:
+      type: "RuntimeDefault"
+
  ## ServiceAccount configuration
  ##
  serviceAccount:
@@ -1390,6 +1432,48 @@ worker:
 ## @section app Parameters
 ##
 app:
+  ## Configure Pods Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
+  ## @param app.podSecurityContext.enabled Enable app pods' Security Context
+  ## @param app.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for app pods
+  ## @param app.podSecurityContext.sysctls Set kernel settings using the sysctl interface for app pods
+  ## @param app.podSecurityContext.supplementalGroups Set filesystem extra groups for app pods
+  ## @param app.podSecurityContext.fsGroup Set fsGroup in app pods' Security Context
+  ##
+  podSecurityContext:
+    enabled: true
+    fsGroupChangePolicy: Always
+    sysctls: []
+    supplementalGroups: []
+    fsGroup: 1001
+    
+  ## Configure Container Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
+  ## @param app.containerSecurityContext.enabled Enabled app container' Security Context
+  ## @param app.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in app container
+  ## @param app.containerSecurityContext.runAsUser Set runAsUser in app container' Security Context
+  ## @param app.containerSecurityContext.runAsGroup Set runAsGroup in app container' Security Context
+  ## @param app.containerSecurityContext.runAsNonRoot Set runAsNonRoot in app container' Security Context
+  ## @param app.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in app container' Security Context
+  ## @param app.containerSecurityContext.privileged Set privileged in app container' Security Context
+  ## @param app.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in app container' Security Context
+  ## @param app.containerSecurityContext.capabilities.drop List of capabilities to be dropped in app container
+  ## @param app.containerSecurityContext.seccompProfile.type Set seccomp profile in app container
+  ##
+  containerSecurityContext:
+    enabled: true
+    seLinuxOptions: {}
+    runAsUser: 1001
+    runAsGroup: 1001
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    privileged: false
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+    seccompProfile:
+      type: "RuntimeDefault"
+      
  ## ServiceAccount configuration
  ##
  serviceAccount: