Add RestrictiveSecurityContext helper to pod package

Provides a centralized helper for building hardened container
SecurityContext for unprivileged workloads: RunAsNonRoot, drops
all capabilities, disables privilege escalation, and applies the
RuntimeDefault seccomp profile.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: lmiccini

modules/common/pod/security.go

@@ -0,0 +1,47 @@
+/*
+Copyright 2026 Red Hat
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package pod
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/utils/ptr"
+)
+
+// RestrictiveSecurityContext returns a hardened container SecurityContext
+// suitable for unprivileged workloads. It sets RunAsNonRoot, drops all
+// capabilities, disables privilege escalation, and applies the RuntimeDefault
+// seccomp profile. The provided uid is used for both RunAsUser and RunAsGroup.
+func RestrictiveSecurityContext(uid int64) *corev1.SecurityContext {
+	return RestrictiveSecurityContextWithGID(uid, uid)
+}
+
+// RestrictiveSecurityContextWithGID is like RestrictiveSecurityContext but
+// allows specifying a different GID.
+func RestrictiveSecurityContextWithGID(uid, gid int64) *corev1.SecurityContext {
+	return &corev1.SecurityContext{
+		RunAsUser:                ptr.To(uid),
+		RunAsGroup:               ptr.To(gid),
+		RunAsNonRoot:             ptr.To(true),
+		AllowPrivilegeEscalation: ptr.To(false),
+		Capabilities: &corev1.Capabilities{
+			Drop: []corev1.Capability{"ALL"},
+		},
+		SeccompProfile: &corev1.SeccompProfile{
+			Type: corev1.SeccompProfileTypeRuntimeDefault,
+		},
+	}
+}

modules/common/pod/security_test.go

@@ -0,0 +1,50 @@
+package pod
+
+import (
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+)
+
+func TestRestrictiveSecurityContext(t *testing.T) {
+	var uid int64 = 42457
+	sc := RestrictiveSecurityContext(uid)
+
+	if sc.RunAsUser == nil || *sc.RunAsUser != uid {
+		t.Errorf("expected RunAsUser %d, got %v", uid, sc.RunAsUser)
+	}
+	if sc.RunAsGroup == nil || *sc.RunAsGroup != uid {
+		t.Errorf("expected RunAsGroup %d, got %v", uid, sc.RunAsGroup)
+	}
+	if sc.RunAsNonRoot == nil || !*sc.RunAsNonRoot {
+		t.Error("expected RunAsNonRoot true")
+	}
+	if sc.AllowPrivilegeEscalation == nil || *sc.AllowPrivilegeEscalation {
+		t.Error("expected AllowPrivilegeEscalation false")
+	}
+	if sc.Capabilities == nil || len(sc.Capabilities.Drop) != 1 || sc.Capabilities.Drop[0] != "ALL" {
+		t.Errorf("expected Capabilities.Drop [ALL], got %v", sc.Capabilities)
+	}
+	if sc.SeccompProfile == nil || sc.SeccompProfile.Type != corev1.SeccompProfileTypeRuntimeDefault {
+		t.Errorf("expected SeccompProfile RuntimeDefault, got %v", sc.SeccompProfile)
+	}
+}
+
+func TestRestrictiveSecurityContextWithGID(t *testing.T) {
+	var uid int64 = 42415
+	var gid int64 = 42416
+	sc := RestrictiveSecurityContextWithGID(uid, gid)
+
+	if sc.RunAsUser == nil || *sc.RunAsUser != uid {
+		t.Errorf("expected RunAsUser %d, got %v", uid, sc.RunAsUser)
+	}
+	if sc.RunAsGroup == nil || *sc.RunAsGroup != gid {
+		t.Errorf("expected RunAsGroup %d, got %v", gid, sc.RunAsGroup)
+	}
+	if sc.RunAsNonRoot == nil || !*sc.RunAsNonRoot {
+		t.Error("expected RunAsNonRoot true")
+	}
+	if sc.AllowPrivilegeEscalation == nil || *sc.AllowPrivilegeEscalation {
+		t.Error("expected AllowPrivilegeEscalation false")
+	}
+}