feat(chart/webapp): expose extraContainers, extraInitContainers, init/sidecar securityContext

Adds four optional values on the webapp deployment:

  - webapp.extraContainers          — sidecars (TLS terminator, log shipper,
                                      audit agent, etc.)
  - webapp.extraInitContainers      — additional inits scheduled after the
                                      built-in volume-permissions init
  - webapp.initContainers.securityContext  — overrides the default
                                      `runAsUser: 1000` on the built-in
                                      volume-permissions init container
  - webapp.sidecarContainers.securityContext — overrides the default
                                      `runAsUser: 1000, runAsNonRoot: true`
                                      on the built-in token-syncer sidecar

Defaults are empty / unset, preserving current behavior. Mirrors the
pattern already supported on the supervisor chart. Lets operators
satisfy strict pod-security admission (PSA "restricted", FedRAMP/IL5,
OpenShift restricted SCC) without forking the chart.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ConProgramming

hosting/k8s/helm/templates/webapp.yaml

@@ -77,18 +77,31 @@ spec:
           image: {{ include "trigger-v4.webapp.volumePermissions.image" . }}
           imagePullPolicy: {{ .Values.webapp.volumePermissions.image.pullPolicy }}
           command: ['sh', '-c', 'mkdir -p /home/node/shared']
+          {{- with .Values.webapp.initContainers.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- else }}
           securityContext:
             runAsUser: 1000
+          {{- end }}
           volumeMounts:
             - name: shared
               mountPath: /home/node/shared
+        {{- with .Values.webapp.extraInitContainers }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       containers:
         - name: token-syncer
           image: {{ include "trigger-v4.webapp.tokenSyncer.image" . }}
           imagePullPolicy: {{ .Values.webapp.tokenSyncer.image.pullPolicy }}
+          {{- with .Values.webapp.sidecarContainers.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- else }}
           securityContext:
             runAsUser: 1000
             runAsNonRoot: true
+          {{- end }}
           command:
             - /bin/bash
             - -c
@@ -414,6 +427,9 @@ spec:
             {{- with .Values.webapp.extraVolumeMounts }}
             {{- toYaml . | nindent 12 }}
             {{- end }}
+        {{- with .Values.webapp.extraContainers }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       volumes:
         - name: shared
           {{- if .Values.persistence.shared.enabled }}

hosting/k8s/helm/values.yaml

@@ -172,6 +172,44 @@ webapp:
     #   mountPath: /etc/ssl/certs
     #   readOnly: true
 
+  # Extra containers added to the webapp pod (sidecars). Useful for
+  # in-pod TLS (nginx, envoy), log shippers, audit agents, etc.
+  extraContainers:
+    []
+    # - name: nginx-tls
+    #   image: nginx:alpine
+    #   ports:
+    #     - name: https-internal
+    #       containerPort: 3031
+    #   volumeMounts:
+    #     - name: nginx-config
+    #       mountPath: /etc/nginx/conf.d
+    #     - name: nginx-tls-certs
+    #       mountPath: /etc/nginx/tls
+
+  # Extra init containers added to the webapp pod, scheduled after the
+  # built-in `volume-permissions` init.
+  extraInitContainers:
+    []
+    # - name: wait-for-secrets
+    #   image: busybox
+    #   command: [...]
+
+  # Container-level securityContext applied to the built-in
+  # `volume-permissions` init container. When unset, defaults to
+  # `runAsUser: 1000`. Set this to enforce stricter pod-security
+  # admission (e.g. FIPS / FedRAMP / Pod Security Standards "restricted":
+  # `runAsNonRoot: true`, `allowPrivilegeEscalation: false`,
+  # `capabilities.drop: [ALL]`, `seccompProfile.type: RuntimeDefault`).
+  initContainers:
+    securityContext: {}
+
+  # Container-level securityContext applied to the built-in `token-syncer`
+  # sidecar. Same shape + intent as `webapp.initContainers.securityContext`.
+  # Defaults to `{ runAsUser: 1000, runAsNonRoot: true }` when unset.
+  sidecarContainers:
+    securityContext: {}
+
   # ServiceMonitor for Prometheus monitoring
   serviceMonitor:
     enabled: false