feat(chart): expose podSecurityContext and securityContext values

Add `podSecurityContext` (pod-level) and `securityContext` (container-level)
values and wire them into both the Deployment and DaemonSet templates.

Secure defaults are provided so the controller no longer runs as root with a
writable root filesystem out of the box, satisfying the Pod Security
"restricted" profile and lint gates such as kube-linter's `run-as-non-root`
and `no-read-only-root-fs`:

- podSecurityContext: runAsNonRoot, runAsUser 65532, RuntimeDefault seccomp
- securityContext: readOnlyRootFilesystem, no privilege escalation, drop ALL

The runtime does not write to its root filesystem, so readOnlyRootFilesystem
is safe. Both blocks are `with`-guarded so operators can relax them by
overriding the values.

Closes #1253

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: vishwakt

chart/.snapshots/default.yaml

@@ -5,6 +5,7 @@ kind: ServiceAccount
 metadata:
   name: hcloud-cloud-controller-manager
   namespace: kube-system
+
 ---
 # Source: hcloud-cloud-controller-manager/templates/clusterrole.yml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -70,6 +71,7 @@ rules:
       - list
       - watch
       - update
+
 ---
 # Source: hcloud-cloud-controller-manager/templates/clusterrolebinding.yaml
 kind: ClusterRoleBinding
@@ -86,6 +88,7 @@ subjects:
   - kind: ServiceAccount
     name: hcloud-cloud-controller-manager
     namespace: kube-system
+
 ---
 # Source: hcloud-cloud-controller-manager/templates/deployment.yaml
 apiVersion: apps/v1
@@ -107,6 +110,11 @@ spec:
         app.kubernetes.io/name: 'hcloud-cloud-controller-manager'
     spec:
       serviceAccountName: hcloud-cloud-controller-manager
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
       dnsPolicy: Default
       tolerations:
         # Allow HCCM itself to schedule on nodes that have not yet been initialized by HCCM.
@@ -128,6 +136,12 @@ spec:
           effect: "NoExecute"
       containers:
         - name: hcloud-cloud-controller-manager
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
           args:
             - "--allow-untagged-cloud"
             - "--cloud-provider=hcloud"

chart/.snapshots/full.daemonset.yaml

@@ -5,6 +5,7 @@ kind: ServiceAccount
 metadata:
   name: hcloud-cloud-controller-manager
   namespace: kube-system
+
 ---
 # Source: hcloud-cloud-controller-manager/templates/clusterrole.yml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -70,6 +71,7 @@ rules:
       - list
       - watch
       - update
+
 ---
 # Source: hcloud-cloud-controller-manager/templates/clusterrolebinding.yaml
 kind: ClusterRoleBinding
@@ -86,6 +88,7 @@ subjects:
   - kind: ServiceAccount
     name: hcloud-cloud-controller-manager
     namespace: kube-system
+
 ---
 # Source: hcloud-cloud-controller-manager/templates/daemonset.yaml
 apiVersion: apps/v1
@@ -109,6 +112,11 @@ spec:
         pod-annotation: pod-annotation
     spec:
       serviceAccountName: hcloud-cloud-controller-manager
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
       dnsPolicy: Default
       tolerations:
         # Allow HCCM itself to schedule on nodes that have not yet been initialized by HCCM.
@@ -137,6 +145,12 @@ spec:
         foo: bar
       containers:
         - name: hcloud-cloud-controller-manager
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
           command:
             - "/bin/hcloud-cloud-controller-manager"
             - "--allow-untagged-cloud"

chart/templates/daemonset.yaml

@@ -26,6 +26,10 @@ spec:
         {{- toYaml . | nindent 8 }}
     {{- end }}
       serviceAccountName: {{ include "hcloud-cloud-controller-manager.name" . }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       dnsPolicy: Default
       tolerations:
         # Allow HCCM itself to schedule on nodes that have not yet been initialized by HCCM.
@@ -60,6 +64,10 @@ spec:
       {{- end }}
       containers:
         - name: hcloud-cloud-controller-manager
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           command:
             - "/bin/hcloud-cloud-controller-manager"
             {{- range $key, $value := $.Values.args }}

chart/templates/deployment.yaml

@@ -31,6 +31,10 @@ spec:
         {{- toYaml . | nindent 8 }}
     {{- end }}
       serviceAccountName: {{ include "hcloud-cloud-controller-manager.name" . }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       dnsPolicy: {{ .Values.dnsPolicy }}
       {{- with .Values.dnsConfig }}
       dnsConfig:
@@ -74,6 +78,10 @@ spec:
       {{- end }}
       containers:
         - name: hcloud-cloud-controller-manager
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           args:
             {{- range $key, $value := $.Values.args }}
             {{- if not (eq $value nil) }}

chart/values.yaml

@@ -120,6 +120,27 @@ resources:
     cpu: 100m
     memory: 50Mi
 
+# Pod-level security context for the hccm Pod.
+# The defaults run the controller as a non-root user with a RuntimeDefault
+# seccomp profile, satisfying the Pod Security "restricted" profile.
+# Set to {} (or override individual fields) to relax these constraints.
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 65532
+  seccompProfile:
+    type: RuntimeDefault
+
+# Container-level security context for the hccm container.
+# The controller does not write to its root filesystem at runtime, so a
+# read-only root filesystem with all capabilities dropped is safe by default.
+# Set to {} (or override individual fields) to relax these constraints.
+securityContext:
+  readOnlyRootFilesystem: true
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+
 selectorLabels:
   app.kubernetes.io/name: '{{ include "hcloud-cloud-controller-manager.name" $ }}'
   app.kubernetes.io/instance: "{{ $.Release.Name }}"

deploy/ccm-networks.yaml

@@ -5,6 +5,7 @@ kind: ServiceAccount
 metadata:
   name: hcloud-cloud-controller-manager
   namespace: kube-system
+
 ---
 # Source: hcloud-cloud-controller-manager/templates/clusterrole.yml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -70,6 +71,7 @@ rules:
       - list
       - watch
       - update
+
 ---
 # Source: hcloud-cloud-controller-manager/templates/clusterrolebinding.yaml
 kind: ClusterRoleBinding
@@ -86,6 +88,7 @@ subjects:
   - kind: ServiceAccount
     name: hcloud-cloud-controller-manager
     namespace: kube-system
+
 ---
 # Source: hcloud-cloud-controller-manager/templates/deployment.yaml
 apiVersion: apps/v1
@@ -105,6 +108,11 @@ spec:
         app: hcloud-cloud-controller-manager
     spec:
       serviceAccountName: hcloud-cloud-controller-manager
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
       dnsPolicy: Default
       tolerations:
         # Allow HCCM itself to schedule on nodes that have not yet been initialized by HCCM.
@@ -127,6 +135,12 @@ spec:
       hostNetwork: true
       containers:
         - name: hcloud-cloud-controller-manager
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
           args:
             - "--allow-untagged-cloud"
             - "--cloud-provider=hcloud"

deploy/ccm.yaml

@@ -5,6 +5,7 @@ kind: ServiceAccount
 metadata:
   name: hcloud-cloud-controller-manager
   namespace: kube-system
+
 ---
 # Source: hcloud-cloud-controller-manager/templates/clusterrole.yml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -70,6 +71,7 @@ rules:
       - list
       - watch
       - update
+
 ---
 # Source: hcloud-cloud-controller-manager/templates/clusterrolebinding.yaml
 kind: ClusterRoleBinding
@@ -86,6 +88,7 @@ subjects:
   - kind: ServiceAccount
     name: hcloud-cloud-controller-manager
     namespace: kube-system
+
 ---
 # Source: hcloud-cloud-controller-manager/templates/deployment.yaml
 apiVersion: apps/v1
@@ -105,6 +108,11 @@ spec:
         app: hcloud-cloud-controller-manager
     spec:
       serviceAccountName: hcloud-cloud-controller-manager
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
       dnsPolicy: Default
       tolerations:
         # Allow HCCM itself to schedule on nodes that have not yet been initialized by HCCM.
@@ -126,6 +134,12 @@ spec:
           effect: "NoExecute"
       containers:
         - name: hcloud-cloud-controller-manager
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
           args:
             - "--allow-untagged-cloud"
             - "--cloud-provider=hcloud"