build: update argocd-agent chart (#1008)

* build: update argocd-agent chart

Signed-off-by: Jayendra Parsai <jparsai@redhat.com>

* build: update argocd-agent chart

Signed-off-by: Jayendra Parsai <jparsai@redhat.com>

* Regenerate chart

Signed-off-by: Siddhesh Ghadi <sghadi1203@gmail.com>

---------

Signed-off-by: Jayendra Parsai <jparsai@redhat.com>
Signed-off-by: Siddhesh Ghadi <sghadi1203@gmail.com>
Co-authored-by: Siddhesh Ghadi <sghadi1203@gmail.com>

Author: jparsai

hack/generate-agent-helm-chart.py

@@ -91,6 +91,19 @@ def update_copied_chart_files(version: str, image_repository: str, image_tag: st
 	image["tag"] = image_tag
 	values["image"] = image
 
+	values["podSecurityContext"] = {
+		"runAsNonRoot": True,
+		"seccompProfile": {"type": "RuntimeDefault"},
+	}
+	values["securityContext"] = {
+		"allowPrivilegeEscalation": False,
+		"capabilities": {"drop": ["ALL"]},
+		"privileged": False,
+		"readOnlyRootFilesystem": True,
+		"runAsNonRoot": True,
+		"seccompProfile": {"type": "RuntimeDefault"},
+	}
+
 	with values_path.open("w", encoding="utf-8") as file:
 		yaml.safe_dump(values, file, sort_keys=False)
 

helm-charts/redhat-argocd-agent/0.9.0/src/values.yaml

@@ -30,11 +30,7 @@ serviceAccount:
   annotations: {}
   automountServiceAccountToken: true
 podSecurityContext:
-  fsGroup: 999
-  fsGroupChangePolicy: OnRootMismatch
-  runAsGroup: 999
   runAsNonRoot: true
-  runAsUser: 999
   seccompProfile:
     type: RuntimeDefault
 securityContext:
@@ -44,9 +40,7 @@ securityContext:
     - ALL
   privileged: false
   readOnlyRootFilesystem: true
-  runAsGroup: 999
   runAsNonRoot: true
-  runAsUser: 999
   seccompProfile:
     type: RuntimeDefault
 rbac: