Skip to content

fix: inherit global security defaults #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
roderik merged 6 commits into from
Sep 18, 2025
Merged

fix: inherit global security defaults #31

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
be8d1f2
feat(charts): share security contexts globally
roderik Sep 18, 2025
692be2b
refactor(charts): drop redundant defaults
roderik Sep 18, 2025
6cffe65
fix(charts): ensure local security contexts take precedence
roderik Sep 18, 2025
2be731d
fix(charts): inherit global security contexts by default
roderik Sep 18, 2025
c72e3bd
refactor(charts): centralize security context merge
roderik Sep 18, 2025
c8ff61e
chore: merge main into feat/global-security-contexts
roderik Sep 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions charts/network/charts/network-bootstrapper/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,3 +77,15 @@ Accepts either a YAML string or a list of init container maps and indents output
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Resolve pod and container security contexts by layering chart values over global defaults.
*/}}
{{- define "network-bootstrapper.securityContexts" -}}
{{- $root := . -}}
{{- $globalValues := ($root.Values.global | default (dict)) -}}
{{- $globalSecurityContexts := dig "securityContexts" $globalValues (dict) -}}
{{- $pod := mergeOverwrite (deepCopy (dig "pod" $globalSecurityContexts (dict))) (default (dict) $root.Values.podSecurityContext) -}}
{{- $container := mergeOverwrite (deepCopy (dig "container" $globalSecurityContexts (dict))) (default (dict) $root.Values.securityContext) -}}
{{- dict "pod" $pod "container" $container | toYaml -}}
{{- end -}}
7 changes: 3 additions & 4 deletions charts/network/charts/network-bootstrapper/templates/job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,9 @@ spec:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "network-bootstrapper.serviceAccountName" . }}
{{- $globalValues := (.Values.global | default (dict)) }}
{{- $globalSecurityContexts := dig "securityContexts" $globalValues (dict) }}
{{- $podSecurityContext := merge (deepCopy (default (dict) .Values.podSecurityContext)) (dig "pod" $globalSecurityContexts (dict)) }}
{{- $containerSecurityContext := merge (deepCopy (default (dict) .Values.securityContext)) (dig "container" $globalSecurityContexts (dict)) }}
{{- $securityContexts := include "network-bootstrapper.securityContexts" . | fromYaml }}
{{- $podSecurityContext := index $securityContexts "pod" }}
{{- $containerSecurityContext := index $securityContexts "container" }}
{{- if $podSecurityContext }}
securityContext:
{{- toYaml $podSecurityContext | nindent 8 }}
Expand Down
12 changes: 12 additions & 0 deletions charts/network/charts/network-nodes/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,3 +126,15 @@ Accepts either a YAML string or a list of init container maps and indents output
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Resolve pod and container security contexts using global defaults plus chart overrides.
*/}}
{{- define "nodes.securityContexts" -}}
{{- $root := . -}}
{{- $globalValues := ($root.Values.global | default (dict)) -}}
{{- $globalSecurityContexts := dig "securityContexts" $globalValues (dict) -}}
{{- $pod := mergeOverwrite (deepCopy (dig "pod" $globalSecurityContexts (dict))) (default (dict) $root.Values.podSecurityContext) -}}
{{- $container := mergeOverwrite (deepCopy (dig "container" $globalSecurityContexts (dict))) (default (dict) $root.Values.securityContext) -}}
{{- dict "pod" $pod "container" $container | toYaml -}}
{{- end -}}
7 changes: 3 additions & 4 deletions charts/network/charts/network-nodes/templates/statefulset-rpc.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,9 @@ spec:
{{- $initContainers := .Values.initContainers | default (dict) }}
{{- $sharedInitContainers := get $initContainers "shared" }}
{{- $rpcInitContainers := get $initContainers "rpc" }}
{{- $globalValues := (.Values.global | default (dict)) }}
{{- $globalSecurityContexts := dig "securityContexts" $globalValues (dict) }}
{{- $podSecurityContext := merge (deepCopy (default (dict) .Values.podSecurityContext)) (dig "pod" $globalSecurityContexts (dict)) }}
{{- $containerSecurityContext := merge (deepCopy (default (dict) .Values.securityContext)) (dig "container" $globalSecurityContexts (dict)) }}
{{- $securityContexts := include "nodes.securityContexts" . | fromYaml }}
{{- $podSecurityContext := index $securityContexts "pod" }}
{{- $containerSecurityContext := index $securityContexts "container" }}
podManagementPolicy: Parallel
replicas: {{ .Values.rpcReplicaCount }}
serviceName: {{ include "nodes.fullname" . }}-rpc
Expand Down
7 changes: 3 additions & 4 deletions charts/network/charts/network-nodes/templates/statefulset-validator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,10 +37,9 @@ spec:
{{- $initContainers := .Values.initContainers | default (dict) }}
{{- $sharedInitContainers := get $initContainers "shared" }}
{{- $validatorInitContainers := get $initContainers "validator" }}
{{- $globalValues := (.Values.global | default (dict)) }}
{{- $globalSecurityContexts := dig "securityContexts" $globalValues (dict) }}
{{- $podSecurityContext := merge (deepCopy (default (dict) .Values.podSecurityContext)) (dig "pod" $globalSecurityContexts (dict)) }}
{{- $containerSecurityContext := merge (deepCopy (default (dict) .Values.securityContext)) (dig "container" $globalSecurityContexts (dict)) }}
{{- $securityContexts := include "nodes.securityContexts" . | fromYaml }}
{{- $podSecurityContext := index $securityContexts "pod" }}
{{- $containerSecurityContext := index $securityContexts "container" }}
podManagementPolicy: Parallel
replicas: {{ $validatorReplicaBudget }}
serviceName: {{ include "nodes.fullname" . }}
Expand Down