Skip to content

Commit 739e843

Browse files
sandert-k8ssandert-k8s
committed
feat: Add toggle for securityContext and PodSecurityContext
1 parent 797deaf commit 739e843

9 files changed

Lines changed: 53 additions & 37 deletions

File tree

‎charts/capsule/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,4 +41,4 @@ annotations:
4141
url: https://projectcapsule.dev/
4242
artifacthub.io/changes: |
4343
- kind: added
44-
description: oci chart reference
44+
description: added toggles for podSecurityContexts and securityContexts

‎charts/capsule/README.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -108,11 +108,11 @@ Here the values you can override:
108108
| global.jobs.kubectl.image.tag | string | `""` | Set the image tag of the helm chart job |
109109
| global.jobs.kubectl.imagePullSecrets | list | `[]` | ImagePullSecrets |
110110
| global.jobs.kubectl.nodeSelector | object | `{}` | Set the node selector |
111-
| global.jobs.kubectl.podSecurityContext | object | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the job pods. |
111+
| global.jobs.kubectl.podSecurityContext | object | `{"enabled":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the job pods. |
112112
| global.jobs.kubectl.priorityClassName | string | `""` | Set a pod priorityClassName |
113113
| global.jobs.kubectl.resources | object | `{}` | Job resources |
114114
| global.jobs.kubectl.restartPolicy | string | `"Never"` | Set the restartPolicy |
115-
| global.jobs.kubectl.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":1002,"runAsNonRoot":true,"runAsUser":1002}` | Security context for the job containers. |
115+
| global.jobs.kubectl.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"enabled":true,"readOnlyRootFilesystem":true,"runAsGroup":1002,"runAsNonRoot":true,"runAsUser":1002}` | Security context for the job containers. |
116116
| global.jobs.kubectl.tolerations | list | `[]` | Set list of tolerations |
117117
| global.jobs.kubectl.topologySpreadConstraints | list | `[]` | Set Topology Spread Constraints |
118118
| global.jobs.kubectl.ttlSecondsAfterFinished | int | `60` | Sets the ttl in seconds after a finished certgen job is deleted. Set to -1 to never delete. |
@@ -130,7 +130,7 @@ Here the values you can override:
130130
| jobs | object | `{}` | Deprecated, use .global.jobs.kubectl instead |
131131
| nodeSelector | object | `{}` | Set the node selector for the Capsule pod |
132132
| podAnnotations | object | `{}` | Annotations to add to the capsule pod. |
133-
| podSecurityContext | object | `{"runAsGroup":1002,"runAsNonRoot":true,"runAsUser":1002,"seccompProfile":{"type":"RuntimeDefault"}}` | Set the securityContext for the Capsule pod |
133+
| podSecurityContext | object | `{"enabled":true,"runAsGroup":1002,"runAsNonRoot":true,"runAsUser":1002,"seccompProfile":{"type":"RuntimeDefault"}}` | Set the securityContext for the Capsule pod |
134134
| ports | list | `[]` | Set additional ports for the deployment |
135135
| priorityClassName | string | `""` | Set the priority class name of the Capsule pod |
136136
| proxy.enabled | bool | `false` | Enable Installation of Capsule Proxy |
@@ -139,7 +139,7 @@ Here the values you can override:
139139
| rbac.resources.create | bool | `false` | |
140140
| rbac.resources.labels."rbac.authorization.k8s.io/aggregate-to-admin" | string | `"true"` | |
141141
| replicaCount | int | `1` | Set the replica count for capsule pod |
142-
| securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true}` | Set the securityContext for the Capsule container |
142+
| securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"enabled":true,"readOnlyRootFilesystem":true}` | Set the securityContext for the Capsule container |
143143
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account. |
144144
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created. |
145145
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and `serviceAccount.create=true`, a name is generated using the fullname template |

‎charts/capsule/templates/crd-lifecycle/job.yaml‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,8 @@ spec:
2828
{{- include "capsule.selectorLabels" . | nindent 8 }}
2929
spec:
3030
restartPolicy: {{ $Values.restartPolicy }}
31-
{{- with $Values.podSecurityContext }}
32-
securityContext:
33-
{{- toYaml . | nindent 8 }}
31+
{{- if $Values.podSecurityContext.enabled }}
32+
securityContext: {{- omit $Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
3433
{{- end }}
3534
{{- with $Values.nodeSelector }}
3635
nodeSelector:
@@ -60,9 +59,8 @@ spec:
6059
- name: crds-hook
6160
image: {{ include "capsule.jobsFullyQualifiedDockerImage" . }}
6261
imagePullPolicy: {{ $Values.image.pullPolicy }}
63-
{{- with $Values.securityContext }}
64-
securityContext:
65-
{{- toYaml . | nindent 10 }}
62+
{{- if $Values.securityContext.enabled }}
63+
securityContext: {{- omit $Values.securityContext "enabled" | toYaml | nindent 10 }}
6664
{{- end }}
6765
command:
6866
- sh

‎charts/capsule/templates/daemonset.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,8 @@ spec:
3030
{{- toYaml . | nindent 8 }}
3131
{{- end }}
3232
serviceAccountName: {{ include "capsule.serviceAccountName" . }}
33-
{{- with .Values.podSecurityContext }}
34-
securityContext:
35-
{{- toYaml . | nindent 8 }}
33+
{{- if .Values.podSecurityContext.enabled }}
34+
securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
3635
{{- end }}
3736
{{- if .Values.manager.hostNetwork }}
3837
hostNetwork: true
@@ -87,7 +86,8 @@ spec:
8786
readOnly: true
8887
resources:
8988
{{- toYaml .Values.manager.resources | nindent 12 }}
90-
securityContext:
91-
{{- toYaml .Values.securityContext | nindent 12 }}
89+
{{- if .Values.securityContext.enabled }}
90+
securityContext: {{- omit .Values.securityContext "enabled" | toYaml | nindent 12 }}
91+
{{- end }}
9292
{{- end }}
9393
{{- end }}

‎charts/capsule/templates/deployment.yaml‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,8 @@ spec:
2929
{{- toYaml . | nindent 8 }}
3030
{{- end }}
3131
serviceAccountName: {{ include "capsule.serviceAccountName" . }}
32-
{{- with .Values.podSecurityContext }}
33-
securityContext:
34-
{{- toYaml . | nindent 8 }}
32+
{{- if .Values.podSecurityContext.enabled }}
33+
securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
3534
{{- end }}
3635
{{- if .Values.manager.hostNetwork }}
3736
hostNetwork: true
@@ -109,11 +108,10 @@ spec:
109108
{{- end }}
110109
resources:
111110
{{- toYaml .Values.manager.resources | nindent 12 }}
112-
securityContext:
113-
{{- if .Values.manager.securityContext }}
114-
{{- toYaml .Values.manager.securityContext | nindent 12 }}
115-
{{- else }}
116-
{{- toYaml .Values.securityContext | nindent 12 }}
117-
{{- end }}
111+
{{- if .Values.manager.securityContext }}
112+
securityContext: {{- omit .Values.manager.securityContext "enabled" | toYaml | nindent 12 }}
113+
{{- else if .Values.securityContext.enabled }}
114+
securityContext: {{- omit .Values.securityContext "enabled" | toYaml | nindent 12 }}
115+
{{- end }}
118116
{{- end }}
119117
{{- end }}

‎charts/capsule/templates/post-install/job.yaml‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,8 @@ spec:
2525
{{- include "capsule.selectorLabels" . | nindent 8 }}
2626
spec:
2727
restartPolicy: {{ $Values.restartPolicy }}
28-
{{- with $Values.podSecurityContext }}
29-
securityContext:
30-
{{- toYaml . | nindent 8 }}
28+
{{- if $Values.podSecurityContext.enabled }}
29+
securityContext: {{- omit $Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
3130
{{- end }}
3231
{{- with $Values.nodeSelector }}
3332
nodeSelector:
@@ -70,9 +69,8 @@ spec:
7069
valueFrom:
7170
fieldRef:
7271
fieldPath: metadata.namespace
73-
{{- with $Values.securityContext }}
74-
securityContext:
75-
{{- toYaml . | nindent 10 }}
72+
{{- if $Values.securityContext.enabled }}
73+
securityContext: {{- omit $Values.securityContext "enabled" | toYaml | nindent 10 }}
7674
{{- end }}
7775
{{- with $Values.resources }}
7876
resources:

‎charts/capsule/templates/pre-delete/job.yaml‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,8 @@ spec:
2525
{{- include "capsule.selectorLabels" . | nindent 8 }}
2626
spec:
2727
restartPolicy: {{ $Values.restartPolicy }}
28-
{{- with $Values.podSecurityContext }}
29-
securityContext:
30-
{{- toYaml . | nindent 8 }}
28+
{{- if $Values.podSecurityContext.enabled }}
29+
securityContext: {{- omit $Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
3130
{{- end }}
3231
{{- with $Values.nodeSelector }}
3332
nodeSelector:
@@ -72,9 +71,8 @@ spec:
7271
valueFrom:
7372
fieldRef:
7473
fieldPath: metadata.namespace
75-
{{- with $Values.securityContext }}
76-
securityContext:
77-
{{- toYaml . | nindent 12 }}
74+
{{- if $Values.securityContext.enabled }}
75+
securityContext: {{- omit $Values.securityContext "enabled" | toYaml | nindent 12 }}
7876
{{- end }}
7977
{{- with $Values.resources }}
8078
resources:

‎charts/capsule/values.schema.json‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,11 @@
102102
"description": "Security context for the job pods.",
103103
"type": "object",
104104
"properties": {
105+
"enabled": {
106+
"default": true,
107+
"title": "enabled",
108+
"type": "boolean"
109+
},
105110
"seccompProfile": {
106111
"type": "object",
107112
"properties": {
@@ -128,6 +133,11 @@
128133
"description": "Security context for the job containers.",
129134
"type": "object",
130135
"properties": {
136+
"enabled": {
137+
"default": true,
138+
"title": "enabled",
139+
"type": "boolean"
140+
},
131141
"allowPrivilegeEscalation": {
132142
"type": "boolean"
133143
},
@@ -464,6 +474,11 @@
464474
"description": "Set the securityContext for the Capsule pod",
465475
"type": "object",
466476
"properties": {
477+
"enabled": {
478+
"default": true,
479+
"title": "enabled",
480+
"type": "boolean"
481+
},
467482
"runAsGroup": {
468483
"type": "integer"
469484
},
@@ -545,6 +560,11 @@
545560
"description": "Set the securityContext for the Capsule container",
546561
"type": "object",
547562
"properties": {
563+
"enabled": {
564+
"default": true,
565+
"title": "enabled",
566+
"type": "boolean"
567+
},
548568
"allowPrivilegeEscalation": {
549569
"type": "boolean"
550570
},

‎charts/capsule/values.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,12 @@ global:
2424
ttlSecondsAfterFinished: 60
2525
# -- Security context for the job pods.
2626
podSecurityContext:
27+
enabled: true
2728
seccompProfile:
2829
type: "RuntimeDefault"
2930
# -- Security context for the job containers.
3031
securityContext:
32+
enabled: true
3133
allowPrivilegeEscalation: false
3234
capabilities:
3335
drop:
@@ -192,6 +194,7 @@ priorityClassName: '' # system-cluster-critical
192194

193195
# -- Set the securityContext for the Capsule pod
194196
podSecurityContext:
197+
enabled: true
195198
seccompProfile:
196199
type: "RuntimeDefault"
197200
runAsGroup: 1002
@@ -200,6 +203,7 @@ podSecurityContext:
200203

201204
# -- Set the securityContext for the Capsule container
202205
securityContext:
206+
enabled: true
203207
capabilities:
204208
drop:
205209
- ALL

0 commit comments

Comments
 (0)