Skip to content

Commit 668a514

Browse files
FabienPapetCopilot
FabienPapet
and
Copilot
committed
feat: add security context, health probes, and fix worker command
- Add podSecurityContext and containerSecurityContext to values.yaml injected into deployment, worker, crons, and jobs templates - Add configurable livenessProbe and readinessProbe (opt-in, empty by default) injected into deployment and worker templates - Fix TODO in worker.yaml: use command+args instead of shell-wrapped command array - Update values.schema.json with new field definitions - Add tests/security_context_test.yaml and tests/probes_test.yaml (86 tests pass) - Add examples/12-security.yaml demonstrating hardened deployment Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent be8cfba commit 668a514

9 files changed

Lines changed: 325 additions & 3 deletions

File tree

‎charts/frankenphp/templates/crons.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,19 @@ spec:
2626
{{- if $.Values.serviceAccount }}
2727
serviceAccountName: {{ include "helm-frankenphp.serviceAccountName" $ }}
2828
{{- end }}
29+
{{- with $.Values.podSecurityContext }}
30+
securityContext:
31+
{{- toYaml . | nindent 12 }}
32+
{{- end }}
2933
restartPolicy: {{ (default .restartPolicy "Never") }}
3034
containers:
3135
- name: {{ $cronName | lower }}
3236
image: "{{ $.Values.image.repository }}:{{ $.Values.image.tag | default $.Chart.AppVersion }}"
3337
imagePullPolicy: {{ $.Values.image.pullPolicy | default "IfNotPresent" }}
38+
{{- with $.Values.containerSecurityContext }}
39+
securityContext:
40+
{{- toYaml . | nindent 16 }}
41+
{{- end }}
3442
command:
3543
- "/bin/sh"
3644
- "-c"

‎charts/frankenphp/templates/deployment.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,18 @@ spec:
2828
{{- if .Values.serviceAccount }}
2929
serviceAccountName: {{ include "helm-frankenphp.serviceAccountName" . }}
3030
{{- end }}
31+
{{- with .Values.podSecurityContext }}
32+
securityContext:
33+
{{- toYaml . | nindent 8 }}
34+
{{- end }}
3135
containers:
3236
- name: {{ .Chart.Name }}
3337
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
3438
imagePullPolicy: {{ .Values.image.pullPolicy | default "IfNotPresent" }}
39+
{{- with .Values.containerSecurityContext }}
40+
securityContext:
41+
{{- toYaml . | nindent 12 }}
42+
{{- end }}
3543
ports:
3644
- name: http
3745
containerPort: 80
@@ -46,6 +54,14 @@ spec:
4654
resources:
4755
{{- toYaml . | nindent 12 }}
4856
{{- end }}
57+
{{- with .Values.livenessProbe }}
58+
livenessProbe:
59+
{{- toYaml . | nindent 12 }}
60+
{{- end }}
61+
{{- with .Values.readinessProbe }}
62+
readinessProbe:
63+
{{- toYaml . | nindent 12 }}
64+
{{- end }}
4965
{{- with .Values.env }}
5066
env:
5167
{{- toYaml . | nindent 12 }}

‎charts/frankenphp/templates/jobs.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,19 @@ spec:
3232
{{- if $context.Values.serviceAccount }}
3333
serviceAccountName: {{ include "helm-frankenphp.serviceAccountName" $context }}
3434
{{- end }}
35+
{{- with $context.Values.podSecurityContext }}
36+
securityContext:
37+
{{- toYaml . | nindent 8 }}
38+
{{- end }}
3539
restartPolicy: {{ $job.restartPolicy | default "OnFailure" }}
3640
containers:
3741
- name: {{ $job.name | replace "_" "-" }}
3842
image: "{{ $context.Values.image.repository }}:{{ $context.Values.image.tag | default $context.Chart.AppVersion }}"
3943
imagePullPolicy: {{ $context.Values.image.pullPolicy | default "IfNotPresent" }}
44+
{{- with $context.Values.containerSecurityContext }}
45+
securityContext:
46+
{{- toYaml . | nindent 12 }}
47+
{{- end }}
4048
command: ["/bin/sh", "-c"]
4149
args:
4250
- {{ $job.command }}

‎charts/frankenphp/templates/worker.yaml‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,19 @@ spec:
3232
{{- if $.Values.serviceAccount }}
3333
serviceAccountName: {{ include "helm-frankenphp.serviceAccountName" $ }}
3434
{{- end }}
35+
{{- with $.Values.podSecurityContext }}
36+
securityContext:
37+
{{- toYaml . | nindent 8 }}
38+
{{- end }}
3539
restartPolicy: Always
3640
containers:
3741
- name: {{ $workerName }}
3842
image: "{{ $.Values.image.repository }}:{{ $.Values.image.tag | default $.Chart.AppVersion }}"
3943
imagePullPolicy: {{ $.Values.image.pullPolicy | default "IfNotPresent" }}
44+
{{- with $.Values.containerSecurityContext }}
45+
securityContext:
46+
{{- toYaml . | nindent 12 }}
47+
{{- end }}
4048
lifecycle:
4149
preStop:
4250
exec:
@@ -45,14 +53,21 @@ spec:
4553
env:
4654
{{- toYaml . | nindent 12 }}
4755
{{- end }}
48-
command: # todo: find a better way to handle this
49-
- "/bin/sh"
50-
- "-c"
56+
command: ["/bin/sh", "-c"]
57+
args:
5158
- {{ .command | quote }}
5259
{{- with $.Values.resources }}
5360
resources:
5461
{{- toYaml . | nindent 12 }}
5562
{{- end }}
63+
{{- with $.Values.livenessProbe }}
64+
livenessProbe:
65+
{{- toYaml . | nindent 12 }}
66+
{{- end }}
67+
{{- with $.Values.readinessProbe }}
68+
readinessProbe:
69+
{{- toYaml . | nindent 12 }}
70+
{{- end }}
5671
{{- if or $.Values.php.ini $.Values.volumeMounts }}
5772
volumeMounts:
5873
{{- if $.Values.php.ini }}

‎charts/frankenphp/tests/probes_test.yaml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
suite: Health Probes
2+
templates:
3+
- deployment.yaml
4+
tests:
5+
- it: should not have livenessProbe by default
6+
asserts:
7+
- notExists:
8+
path: spec.template.spec.containers[0].livenessProbe
9+
10+
- it: should not have readinessProbe by default
11+
asserts:
12+
- notExists:
13+
path: spec.template.spec.containers[0].readinessProbe
14+
15+
- it: should set livenessProbe when configured
16+
set:
17+
livenessProbe:
18+
httpGet:
19+
path: /
20+
port: http
21+
initialDelaySeconds: 10
22+
periodSeconds: 10
23+
asserts:
24+
- equal:
25+
path: spec.template.spec.containers[0].livenessProbe.httpGet.path
26+
value: /
27+
- equal:
28+
path: spec.template.spec.containers[0].livenessProbe.httpGet.port
29+
value: http
30+
- equal:
31+
path: spec.template.spec.containers[0].livenessProbe.initialDelaySeconds
32+
value: 10
33+
34+
- it: should set readinessProbe when configured
35+
set:
36+
readinessProbe:
37+
httpGet:
38+
path: /
39+
port: http
40+
initialDelaySeconds: 5
41+
periodSeconds: 10
42+
asserts:
43+
- equal:
44+
path: spec.template.spec.containers[0].readinessProbe.httpGet.path
45+
value: /
46+
- equal:
47+
path: spec.template.spec.containers[0].readinessProbe.initialDelaySeconds
48+
value: 5
49+
50+
- it: should support exec probe
51+
set:
52+
livenessProbe:
53+
exec:
54+
command:
55+
- php
56+
- -r
57+
- "echo 'ok';"
58+
periodSeconds: 30
59+
asserts:
60+
- equal:
61+
path: spec.template.spec.containers[0].livenessProbe.exec.command[0]
62+
value: php
63+
---
64+
suite: Health Probes - Workers
65+
templates:
66+
- worker.yaml
67+
tests:
68+
- it: should not have livenessProbe in workers by default
69+
set:
70+
consumers:
71+
- name: "queue"
72+
command: "php bin/console messenger:consume"
73+
asserts:
74+
- notExists:
75+
path: spec.template.spec.containers[0].livenessProbe
76+
77+
- it: should set livenessProbe in workers when configured
78+
set:
79+
consumers:
80+
- name: "queue"
81+
command: "php bin/console messenger:consume"
82+
livenessProbe:
83+
httpGet:
84+
path: /
85+
port: http
86+
periodSeconds: 10
87+
asserts:
88+
- equal:
89+
path: spec.template.spec.containers[0].livenessProbe.httpGet.path
90+
value: /

‎charts/frankenphp/tests/security_context_test.yaml‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
suite: Security Context
2+
templates:
3+
- deployment.yaml
4+
tests:
5+
- it: should not have podSecurityContext by default
6+
asserts:
7+
- notExists:
8+
path: spec.template.spec.securityContext
9+
10+
- it: should set podSecurityContext when configured
11+
set:
12+
podSecurityContext:
13+
runAsNonRoot: true
14+
runAsUser: 1000
15+
asserts:
16+
- equal:
17+
path: spec.template.spec.securityContext.runAsNonRoot
18+
value: true
19+
- equal:
20+
path: spec.template.spec.securityContext.runAsUser
21+
value: 1000
22+
23+
- it: should not have containerSecurityContext by default
24+
asserts:
25+
- notExists:
26+
path: spec.template.spec.containers[0].securityContext
27+
28+
- it: should set containerSecurityContext when configured
29+
set:
30+
containerSecurityContext:
31+
allowPrivilegeEscalation: false
32+
runAsNonRoot: true
33+
asserts:
34+
- equal:
35+
path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
36+
value: false
37+
- equal:
38+
path: spec.template.spec.containers[0].securityContext.runAsNonRoot
39+
value: true
40+
41+
- it: should support capabilities drop in containerSecurityContext
42+
set:
43+
containerSecurityContext:
44+
capabilities:
45+
drop:
46+
- ALL
47+
asserts:
48+
- equal:
49+
path: spec.template.spec.containers[0].securityContext.capabilities.drop[0]
50+
value: ALL
51+
---
52+
suite: Security Context - Workers
53+
templates:
54+
- worker.yaml
55+
tests:
56+
- it: should not have podSecurityContext in workers by default
57+
set:
58+
consumers:
59+
- name: "queue"
60+
command: "php bin/console messenger:consume"
61+
asserts:
62+
- notExists:
63+
path: spec.template.spec.securityContext
64+
65+
- it: should set podSecurityContext in workers when configured
66+
set:
67+
consumers:
68+
- name: "queue"
69+
command: "php bin/console messenger:consume"
70+
podSecurityContext:
71+
runAsNonRoot: true
72+
asserts:
73+
- equal:
74+
path: spec.template.spec.securityContext.runAsNonRoot
75+
value: true
76+
77+
- it: should set containerSecurityContext in workers when configured
78+
set:
79+
consumers:
80+
- name: "queue"
81+
command: "php bin/console messenger:consume"
82+
containerSecurityContext:
83+
allowPrivilegeEscalation: false
84+
asserts:
85+
- equal:
86+
path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
87+
value: false

‎charts/frankenphp/values.schema.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -352,6 +352,22 @@
352352
"items": {
353353
"type": "object"
354354
}
355+
},
356+
"podSecurityContext": {
357+
"type": "object",
358+
"description": "Pod-level security context applied to all workloads"
359+
},
360+
"containerSecurityContext": {
361+
"type": "object",
362+
"description": "Container-level security context applied to all containers"
363+
},
364+
"livenessProbe": {
365+
"type": "object",
366+
"description": "Liveness probe configuration for the main deployment and workers"
367+
},
368+
"readinessProbe": {
369+
"type": "object",
370+
"description": "Readiness probe configuration for the main deployment and workers"
355371
}
356372
}
357373
}

‎charts/frankenphp/values.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,40 @@ consumers: []
5050
# command: "php bin/console messenger:consume"
5151
# replicas: 1
5252

53+
podSecurityContext: {}
54+
# runAsNonRoot: true
55+
# runAsUser: 1000
56+
# fsGroup: 1000
57+
# seccompProfile:
58+
# type: RuntimeDefault
59+
60+
containerSecurityContext: {}
61+
# allowPrivilegeEscalation: false
62+
# readOnlyRootFilesystem: false
63+
# runAsNonRoot: true
64+
# runAsUser: 1000
65+
# capabilities:
66+
# drop:
67+
# - ALL
68+
# seccompProfile:
69+
# type: RuntimeDefault
70+
71+
livenessProbe: {}
72+
# httpGet:
73+
# path: /
74+
# port: http
75+
# initialDelaySeconds: 10
76+
# periodSeconds: 10
77+
# failureThreshold: 3
78+
79+
readinessProbe: {}
80+
# httpGet:
81+
# path: /
82+
# port: http
83+
# initialDelaySeconds: 5
84+
# periodSeconds: 10
85+
# failureThreshold: 3
86+
5387
affinity: {}
5488

5589
nodeSelector: {}

0 commit comments

Comments
 (0)