feat: allow to custom pod securityContext in gateway-helm (#9036)

* feat: allow to custom pod securityContext in gateway-helm

Signed-off-by: zirain <zirain2009@gmail.com>

* add default value

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>

Author: zirain

charts/gateway-helm/README.md

@@ -111,6 +111,10 @@ helm uninstall eg -n envoy-gateway-system
 | deployment.pod.extraVolumes | list | `[]` |  |
 | deployment.pod.labels | object | `{}` |  |
 | deployment.pod.nodeSelector | object | `{}` |  |
+| deployment.pod.securityContext.runAsGroup | int | `65532` |  |
+| deployment.pod.securityContext.runAsNonRoot | bool | `true` |  |
+| deployment.pod.securityContext.runAsUser | int | `65532` |  |
+| deployment.pod.securityContext.seccompProfile.type | string | `"RuntimeDefault"` |  |
 | deployment.pod.tolerations | list | `[]` |  |
 | deployment.pod.topologySpreadConstraints | list | `[]` |  |
 | deployment.ports[0].name | string | `"grpc"` |  |

charts/gateway-helm/templates/envoy-gateway-deployment.yaml

@@ -48,6 +48,10 @@ spec:
       tolerations:
         {{- toYaml . | nindent 6 }}
       {{- end }}
+      {{- with .Values.deployment.pod.securityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - args:
         - server

charts/gateway-helm/values.tmpl.yaml

@@ -104,6 +104,12 @@ deployment:
     # - name: foo
     #   configMap:
     #     name: myconfigmap
+    securityContext:
+      runAsNonRoot: true
+      runAsGroup: 65532
+      runAsUser: 65532
+      seccompProfile:
+        type: RuntimeDefault
 
 service:
   # If set to PreferClose, the Envoy fleet will prioritize connecting to the Envoy Gateway pods that are topologically closest to them.

site/content/en/latest/install/gateway-helm-api.md

@@ -56,6 +56,10 @@ The Helm chart for Envoy Gateway
 | deployment.pod.extraVolumes | list | `[]` |  |
 | deployment.pod.labels | object | `{}` |  |
 | deployment.pod.nodeSelector | object | `{}` |  |
+| deployment.pod.securityContext.runAsGroup | int | `65532` |  |
+| deployment.pod.securityContext.runAsNonRoot | bool | `true` |  |
+| deployment.pod.securityContext.runAsUser | int | `65532` |  |
+| deployment.pod.securityContext.seccompProfile.type | string | `"RuntimeDefault"` |  |
 | deployment.pod.tolerations | list | `[]` |  |
 | deployment.pod.topologySpreadConstraints | list | `[]` |  |
 | deployment.ports[0].name | string | `"grpc"` |  |

test/helm/gateway-helm/certgen-annotations.out.yaml

@@ -441,6 +441,12 @@ spec:
         app.kubernetes.io/instance: gateway-helm
     spec:
       automountServiceAccountToken: true
+      securityContext:
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - args:
         - server

test/helm/gateway-helm/certgen-args.out.yaml

@@ -441,6 +441,12 @@ spec:
         app.kubernetes.io/instance: gateway-helm
     spec:
       automountServiceAccountToken: true
+      securityContext:
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - args:
         - server

test/helm/gateway-helm/certgen-labels.out.yaml

@@ -441,6 +441,12 @@ spec:
         app.kubernetes.io/instance: gateway-helm
     spec:
       automountServiceAccountToken: true
+      securityContext:
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - args:
         - server

test/helm/gateway-helm/certjen-custom-scheduling.out.yaml

@@ -441,6 +441,12 @@ spec:
         app.kubernetes.io/instance: gateway-helm
     spec:
       automountServiceAccountToken: true
+      securityContext:
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - args:
         - server

test/helm/gateway-helm/common-labels.out.yaml

@@ -481,6 +481,12 @@ spec:
         app.kubernetes.io/instance: gateway-helm
     spec:
       automountServiceAccountToken: true
+      securityContext:
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - args:
         - server

test/helm/gateway-helm/control-plane-with-pdb.out.yaml

@@ -456,6 +456,12 @@ spec:
         app.kubernetes.io/instance: gateway-helm
     spec:
       automountServiceAccountToken: true
+      securityContext:
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - args:
         - server