Make privilege escalation configurable in Helm (#7521)

Disabling privilege escalation is a security best practice. But
currently this is not supported when installing from Helm.

A parameter called `privilegeEscalationEnabled` is added to the Helm
chart. The default value is `true`to avoid breaking changes to the Helm
chart.

Fixes #7282

Signed-off-by: Kim Christensen <kimworking@gmail.com>

Author: kichristensen

charts/linkerd-control-plane/templates/destination.yaml

@@ -218,6 +218,7 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
+          allowPrivilegeEscalation: false
       - args:
         - sp-validator
         - -log-level={{.Values.controllerLogLevel}}
@@ -245,6 +246,7 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /var/run/linkerd/tls
           name: sp-tls
@@ -289,6 +291,7 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /var/run/linkerd/tls
           name: policy-tls

charts/linkerd-control-plane/templates/heartbeat.yaml

@@ -63,4 +63,5 @@ spec:
             {{- end }}
             securityContext:
               runAsUser: {{.Values.controllerUID}}
+              allowPrivilegeEscalation: false
 {{- end }}

charts/linkerd-control-plane/templates/identity.yaml

@@ -179,6 +179,7 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /var/run/linkerd/identity/issuer
           name: identity-issuer

charts/linkerd-control-plane/templates/proxy-injector.yaml

@@ -97,6 +97,7 @@ spec:
         {{- end }}
         securityContext:
           runAsUser: {{.Values.controllerUID}}
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /var/run/linkerd/config
           name: config