Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(securityContext): Add the ability to set securityContext values #135

Merged
merged 3 commits into from
Jan 2, 2024

Conversation

bryopsida
Copy link
Contributor

What this PR does / why we need it:

Adds the capability to set securityContext values at the pod and container levels. This is needed in order to deploy into a namespace with PSA enforcing at the restricted level.

Special notes for your reviewer:

Tested with the following labels set on namespace.

  labels:
    kubernetes.io/metadata.name: couchdb-test
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/warn: restricted

And the following overrides

podSecurityContext:
  seccompProfile:
   type: RuntimeDefault
  fsGroup: 5984
  fsGroupChangePolicy: "Always"
containerSecurityContext:
  runAsNonRoot: true
  runAsUser: 5984
  runAsGroup: 5984
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL

Pods passed PSA enforcement and entered a ready state.

These values are optional and if users do not provide overrides for these values there will be no change to existing installs/releases.

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.

  • Chart Version bumped
  • e2e tests pass
  • Variables are documented in the README.md

Adds the capability to set securityContext values at the pod and container levels. This is needed in order to deploy into a namespace with PSA enforcing at the restricted level.

Signed-off-by: bryopsida <[email protected]>
@willholley
Copy link
Member

thanks @bryopsida - looks like a good change to me. I wonder whether we'd want to default to these securityContext values assuming they are compatible with the official images, though that's probably one for a major release.

@willholley willholley merged commit d85bc67 into apache:main Jan 2, 2024
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants