From 773c6d5a15883980d48929eb9b2e5a3f4fbebf63 Mon Sep 17 00:00:00 2001 From: Zadkiel AHARONIAN Date: Wed, 19 Aug 2026 16:36:06 +0200 Subject: [PATCH 1/3] feat(deployment): drop all capabilities in default security context Signed-off-by: Zadkiel AHARONIAN --- README.md | 2 +- application/tests/deployment_test.yaml | 12 ++++++++++++ application/values.schema.json | 24 ++++++++++++++++++++++++ application/values.yaml | 4 ++++ 4 files changed, 41 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 2e35d02a..09532d95 100644 --- a/README.md +++ b/README.md @@ -142,7 +142,7 @@ Please refer to the [Contributing Guide](CONTRIBUTING.md) for details on how to | deployment.livenessProbe.tcpSocket | object | `{}` | TCP Socket probe. | | deployment.livenessProbe.grpc | object | `{}` | gRPC probe. | | deployment.resources | object | `{}` | Resource limits and requests for the pod. | -| deployment.containerSecurityContext | object, null | `{"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Security Context at Container Level. | +| deployment.containerSecurityContext | object, null | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Security Context at Container Level. | | deployment.openshiftOAuthProxy.enabled | bool | `false` | Enable [OpenShift OAuth Proxy](https://github.com/openshift/oauth-proxy). | | deployment.openshiftOAuthProxy.port | int | `8080` | Port on which application is running inside container. | | deployment.openshiftOAuthProxy.secretName | string | `"openshift-oauth-proxy-tls"` | Secret name for the OAuth Proxy TLS certificate. | diff --git a/application/tests/deployment_test.yaml b/application/tests/deployment_test.yaml index 019f8b61..bbae017f 100644 --- a/application/tests/deployment_test.yaml +++ b/application/tests/deployment_test.yaml @@ -8,6 +8,18 @@ set: deployment.image.tag: example-tag tests: + - it: applies a restricted container security context by default + asserts: + - equal: + path: spec.template.spec.containers[0].securityContext + value: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - it: does not include OAuth proxy container if disabled set: deployment.openshiftOAuthProxy.enabled: false diff --git a/application/values.schema.json b/application/values.schema.json index 3ac7584e..0a6b0d0e 100644 --- a/application/values.schema.json +++ b/application/values.schema.json @@ -838,6 +838,30 @@ "containerSecurityContext": { "description": "Security Context at Container Level.", "properties": { + "allowPrivilegeEscalation": { + "default": false, + "title": "allowPrivilegeEscalation", + "type": "boolean" + }, + "capabilities": { + "properties": { + "drop": { + "items": { + "anyOf": [ + { + "type": "string" + } + ], + "required": [] + }, + "title": "drop", + "type": "array" + } + }, + "required": [], + "title": "capabilities", + "type": "object" + }, "readOnlyRootFilesystem": { "default": true, "title": "readOnlyRootFilesystem", diff --git a/application/values.yaml b/application/values.yaml index 293fc4ab..f8b7b5f6 100644 --- a/application/values.yaml +++ b/application/values.yaml @@ -463,6 +463,10 @@ deployment: containerSecurityContext: readOnlyRootFilesystem: true runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL openshiftOAuthProxy: # -- (bool) Enable [OpenShift OAuth Proxy](https://github.com/openshift/oauth-proxy). # @section -- Deployment Parameters From 9b9d8ba7f5786b3e588b9d21eb5d7366db6a25f3 Mon Sep 17 00:00:00 2001 From: Zadkiel AHARONIAN Date: Wed, 19 Aug 2026 16:42:22 +0200 Subject: [PATCH 2/3] feat(deployment): add seccomp default and oauth proxy security context Signed-off-by: Zadkiel AHARONIAN --- README.md | 3 +- application/templates/deployment.yaml | 4 ++ .../tests/__snapshot__/common_test.yaml.snap | 7 +++ application/tests/deployment_test.yaml | 25 ++++++++ application/values.schema.json | 60 ++++++++++++++++++- application/values.yaml | 11 ++++ 6 files changed, 108 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 09532d95..6b804d03 100644 --- a/README.md +++ b/README.md @@ -145,10 +145,11 @@ Please refer to the [Contributing Guide](CONTRIBUTING.md) for details on how to | deployment.containerSecurityContext | object, null | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Security Context at Container Level. | | deployment.openshiftOAuthProxy.enabled | bool | `false` | Enable [OpenShift OAuth Proxy](https://github.com/openshift/oauth-proxy). | | deployment.openshiftOAuthProxy.port | int | `8080` | Port on which application is running inside container. | +| deployment.openshiftOAuthProxy.containerSecurityContext | object, null | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Security Context for the OAuth Proxy container. | | deployment.openshiftOAuthProxy.secretName | string | `"openshift-oauth-proxy-tls"` | Secret name for the OAuth Proxy TLS certificate. | | deployment.openshiftOAuthProxy.image | string | `"quay.io/openshift/origin-oauth-proxy:latest@sha256:35967c4d152d7b21167e3ba0aae57e29d3a46a75a738329073ef2227cbc33bde"` | Image for the OAuth Proxy. | | deployment.openshiftOAuthProxy.disableTLSArg | bool | `false` | If disabled `--http-address=:8081` will be used instead of `--https-address=:8443`. It can be useful when an ingress is enabled for the application. | -| deployment.securityContext | object, null | `nil` | Security Context for the pod. | +| deployment.securityContext | object, null | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Security Context for the pod. | | deployment.command | list | `[]` | Command for the app container. | | deployment.args | list | `[]` | Args for the app container. | | deployment.automountServiceAccountToken | bool | `false` | Mount Service Account token. | diff --git a/application/templates/deployment.yaml b/application/templates/deployment.yaml index c7cfe2c8..6b336d01 100644 --- a/application/templates/deployment.yaml +++ b/application/templates/deployment.yaml @@ -138,6 +138,10 @@ spec: - containerPort: 8443 {{- end }} name: proxy + {{- with .Values.deployment.openshiftOAuthProxy.containerSecurityContext }} + securityContext: + {{- toYaml . | nindent 10 }} + {{- end }} volumeMounts: - mountPath: /etc/tls/private name: proxy-tls diff --git a/application/tests/__snapshot__/common_test.yaml.snap b/application/tests/__snapshot__/common_test.yaml.snap index 4e9b2f2a..5d983c27 100644 --- a/application/tests/__snapshot__/common_test.yaml.snap +++ b/application/tests/__snapshot__/common_test.yaml.snap @@ -399,6 +399,13 @@ should match snapshot: ports: - containerPort: 8443 name: proxy + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true volumeMounts: - mountPath: /etc/tls/private name: proxy-tls diff --git a/application/tests/deployment_test.yaml b/application/tests/deployment_test.yaml index bbae017f..a96285f9 100644 --- a/application/tests/deployment_test.yaml +++ b/application/tests/deployment_test.yaml @@ -20,6 +20,31 @@ tests: drop: - ALL + - it: applies the runtime default seccomp profile at pod level by default + asserts: + - equal: + path: spec.template.spec.securityContext + value: + seccompProfile: + type: RuntimeDefault + + - it: applies a restricted security context to the OAuth proxy container + set: + deployment.openshiftOAuthProxy.enabled: true + asserts: + - equal: + path: spec.template.spec.containers[0].name + value: oauth-proxy + - equal: + path: spec.template.spec.containers[0].securityContext + value: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - it: does not include OAuth proxy container if disabled set: deployment.openshiftOAuthProxy.enabled: false diff --git a/application/values.schema.json b/application/values.schema.json index 0a6b0d0e..1105fb40 100644 --- a/application/values.schema.json +++ b/application/values.schema.json @@ -1105,6 +1105,51 @@ }, "openshiftOAuthProxy": { "properties": { + "containerSecurityContext": { + "description": "Security Context for the OAuth Proxy container.", + "properties": { + "allowPrivilegeEscalation": { + "default": false, + "title": "allowPrivilegeEscalation", + "type": "boolean" + }, + "capabilities": { + "properties": { + "drop": { + "items": { + "anyOf": [ + { + "type": "string" + } + ], + "required": [] + }, + "title": "drop", + "type": "array" + } + }, + "required": [], + "title": "capabilities", + "type": "object" + }, + "readOnlyRootFilesystem": { + "default": true, + "title": "readOnlyRootFilesystem", + "type": "boolean" + }, + "runAsNonRoot": { + "default": true, + "title": "runAsNonRoot", + "type": "boolean" + } + }, + "required": [], + "title": "containerSecurityContext", + "type": [ + "object", + "null" + ] + }, "disableTLSArg": { "default": false, "description": "If disabled `--http-address=:8081` will be used instead of `--https-address=:8443`. It can be useful when an ingress is enabled for the application.", @@ -1275,8 +1320,21 @@ ] }, "securityContext": { - "default": "", "description": "Security Context for the pod.", + "properties": { + "seccompProfile": { + "properties": { + "type": { + "default": "RuntimeDefault", + "title": "type", + "type": "string" + } + }, + "required": [], + "title": "seccompProfile", + "type": "object" + } + }, "required": [], "title": "securityContext", "type": [ diff --git a/application/values.yaml b/application/values.yaml index f8b7b5f6..7ac9a60b 100644 --- a/application/values.yaml +++ b/application/values.yaml @@ -474,6 +474,15 @@ deployment: # -- (int) Port on which application is running inside container. # @section -- Deployment Parameters port: 8080 + # -- (object, null) Security Context for the OAuth Proxy container. + # @section -- Deployment Parameters + containerSecurityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL # -- (string) Secret name for the OAuth Proxy TLS certificate. # @section -- Deployment Parameters secretName: "openshift-oauth-proxy-tls" @@ -487,6 +496,8 @@ deployment: # -- (object, null) Security Context for the pod. # @section -- Deployment Parameters securityContext: + seccompProfile: + type: RuntimeDefault # fsGroup: 2000 # -- (list) Command for the app container. # @section -- Deployment Parameters From c250b4bd213b3162f8c963aba5333b985dafe301 Mon Sep 17 00:00:00 2001 From: Zadkiel AHARONIAN Date: Wed, 19 Aug 2026 16:48:50 +0200 Subject: [PATCH 3/3] feat(security): extend restricted defaults to jobs and all containers Signed-off-by: Zadkiel AHARONIAN --- README.md | 4 + application/templates/cronjob.yaml | 10 +- application/templates/deployment.yaml | 16 ++- application/templates/job.yaml | 10 +- application/tests/cronjob_test.yaml | 57 ++++++++++- application/tests/deployment_test.yaml | 60 +++++++++++ application/tests/job_test.yaml | 57 ++++++++++- application/values.schema.json | 136 +++++++++++++++++++++++++ application/values.yaml | 28 +++++ 9 files changed, 365 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 6b804d03..6f62c1cf 100644 --- a/README.md +++ b/README.md @@ -68,6 +68,8 @@ Please refer to the [Contributing Guide](CONTRIBUTING.md) for details on how to | Key | Type | Default | Description | |-----|------|---------|-------------| | cronJob.enabled | bool | `false` | Deploy CronJob resources. | +| cronJob.securityContext | object, null | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Default Security Context at pod level for all CronJobs. Can be overridden per job with `securityContext`. | +| cronJob.containerSecurityContext | object, null | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Default Security Context at container level for all CronJobs. Can be overridden per job with `containerSecurityContext`. | | cronJob.jobs | object, null | `nil` | Map of CronJob resources. Key will be used as a name suffix for the CronJob. Value is the CronJob configuration. See values for more details. | ### Job Parameters @@ -75,6 +77,8 @@ Please refer to the [Contributing Guide](CONTRIBUTING.md) for details on how to | Key | Type | Default | Description | |-----|------|---------|-------------| | job.enabled | bool | `false` | Deploy Job resources. | +| job.securityContext | object, null | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Default Security Context at pod level for all Jobs. Can be overridden per job with `securityContext`. | +| job.containerSecurityContext | object, null | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Default Security Context at container level for all Jobs. Can be overridden per job with `containerSecurityContext`. | | job.jobs | object, null | `nil` | Map of Job resources. Key will be used as a name suffix for the Job. Value is the Job configuration. See values for more details. | ### Deployment Parameters diff --git a/application/templates/cronjob.yaml b/application/templates/cronjob.yaml index 0e82c095..5c18a873 100644 --- a/application/templates/cronjob.yaml +++ b/application/templates/cronjob.yaml @@ -69,6 +69,12 @@ spec: {{- range $key, $value := . }} - name: {{ $key }} {{- dict "value" (omit $value "name") "context" $ | include "application.tplvalues.render" | nindent 12 }} + {{- if not (hasKey $value "securityContext") }} + {{- with $job.containerSecurityContext | default $.Values.cronJob.containerSecurityContext }} + securityContext: + {{- toYaml . | nindent 14 }} + {{- end }} + {{- end }} {{- end }} {{- end }} containers: @@ -135,7 +141,7 @@ spec: volumeMounts: {{ toYaml . | indent 12 }} {{- end }} - {{- with $job.containerSecurityContext }} + {{- with $job.containerSecurityContext | default $.Values.cronJob.containerSecurityContext }} securityContext: {{- toYaml . | nindent 14 }} {{- end }} @@ -165,7 +171,7 @@ spec: imagePullSecrets: {{- toYaml . | nindent 12 }} {{- end }} - {{- with $job.securityContext }} + {{- with $job.securityContext | default $.Values.cronJob.securityContext }} securityContext: {{- toYaml . | nindent 12 }} {{- end }} diff --git a/application/templates/deployment.yaml b/application/templates/deployment.yaml index 6b336d01..30d4225d 100644 --- a/application/templates/deployment.yaml +++ b/application/templates/deployment.yaml @@ -86,6 +86,12 @@ spec: {{- range $key, $value := .Values.deployment.initContainers }} - name: {{ $key }} {{ include "application.tplvalues.render" ( dict "value" $value "context" $ ) | indent 8 }} + {{- if not (hasKey $value "securityContext") }} + {{- with $.Values.deployment.containerSecurityContext }} + securityContext: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- end }} {{- end }} {{- end }} {{- if .Values.deployment.nodeSelector }} @@ -301,10 +307,18 @@ spec: {{- $containers := . }} {{- range $name := keys . | sortAlpha }} {{- $container := index $containers $name }} + {{- if and (not (hasKey $container "securityContext")) $.Values.deployment.containerSecurityContext }} + {{- $container = merge (dict "securityContext" $.Values.deployment.containerSecurityContext) $container }} + {{- end }} - {{- merge (dict "name" $name) $container | toYaml | nindent 8 }} {{- end }} {{- else }} -{{ toYaml . | indent 6 }} + {{- range $container := . }} + {{- if and (not (hasKey $container "securityContext")) $.Values.deployment.containerSecurityContext }} + {{- $container = merge (dict "securityContext" $.Values.deployment.containerSecurityContext) $container }} + {{- end }} + - {{- $container | toYaml | nindent 8 }} + {{- end }} {{- end }} {{- end }} {{- if .Values.deployment.securityContext }} diff --git a/application/templates/job.yaml b/application/templates/job.yaml index 361546e4..aacb22e3 100644 --- a/application/templates/job.yaml +++ b/application/templates/job.yaml @@ -49,6 +49,12 @@ spec: {{- range $key, $value := . }} - name: {{ $key }} {{- dict "value" (omit $value "name") "context" $ | include "application.tplvalues.render" | nindent 8 }} + {{- if not (hasKey $value "securityContext") }} + {{- with $job.containerSecurityContext | default $.Values.job.containerSecurityContext }} + securityContext: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- end }} {{- end }} {{- end }} containers: @@ -111,7 +117,7 @@ spec: resources: {{ toYaml . | indent 10 }} {{- end }} - {{- with $job.containerSecurityContext }} + {{- with $job.containerSecurityContext | default $.Values.job.containerSecurityContext }} securityContext: {{- toYaml . | nindent 10 }} {{- end }} @@ -133,7 +139,7 @@ spec: {{- with $job.topologySpreadConstraints }} topologySpreadConstraints: {{ toYaml . | nindent 8 }} {{- end }} - {{- with $job.securityContext }} + {{- with $job.securityContext | default $.Values.job.securityContext }} securityContext: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/application/tests/cronjob_test.yaml b/application/tests/cronjob_test.yaml index 58e644c2..629482c1 100644 --- a/application/tests/cronjob_test.yaml +++ b/application/tests/cronjob_test.yaml @@ -213,11 +213,13 @@ tests: content: name: example1 image: another-example-registry/another-example-image:another-example-tag + any: true - contains: path: spec.jobTemplate.spec.template.spec.initContainers content: name: example2 image: another-example-registry/another-example-image:another-example-tag + any: true - notContains: path: spec.jobTemplate.spec.template.spec.initContainers content: @@ -398,7 +400,7 @@ tests: path: spec.jobTemplate.spec.template.spec.serviceAccountName value: example-app - - it: does not include container security context by default + - it: applies the default security context to init containers unless overridden set: cronJob: enabled: true @@ -407,9 +409,53 @@ tests: image: repository: example-registry/example-image tag: example-tag + initContainers: + plain: + image: busybox + custom: + image: busybox + securityContext: + runAsNonRoot: false asserts: - - notExists: + - contains: + path: spec.jobTemplate.spec.template.spec.initContainers + content: + name: plain + image: busybox + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - contains: + path: spec.jobTemplate.spec.template.spec.initContainers + content: + name: custom + image: busybox + securityContext: + runAsNonRoot: false + + - it: applies a restricted container security context by default + set: + cronJob: + enabled: true + jobs: + example: + image: + repository: example-registry/example-image + tag: example-tag + asserts: + - equal: path: spec.jobTemplate.spec.template.spec.containers[0].securityContext + value: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL - it: enable container security context when configured set: @@ -465,7 +511,7 @@ tests: path: spec.jobTemplate.spec.template.spec.automountServiceAccountToken value: true - - it: does not include pod security context by default + - it: applies the runtime default seccomp profile at pod level by default set: cronJob: enabled: true @@ -475,8 +521,11 @@ tests: repository: example-registry/example-image tag: example-tag asserts: - - notExists: + - equal: path: spec.jobTemplate.spec.template.spec.securityContext + value: + seccompProfile: + type: RuntimeDefault - it: enable pod security context when configured set: diff --git a/application/tests/deployment_test.yaml b/application/tests/deployment_test.yaml index a96285f9..90e77a01 100644 --- a/application/tests/deployment_test.yaml +++ b/application/tests/deployment_test.yaml @@ -20,6 +20,66 @@ tests: drop: - ALL + - it: applies the default security context to init containers unless overridden + set: + deployment.initContainers: + plain: + image: busybox + custom: + image: busybox + securityContext: + runAsNonRoot: false + asserts: + - contains: + path: spec.template.spec.initContainers + content: + name: plain + image: busybox + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - contains: + path: spec.template.spec.initContainers + content: + name: custom + image: busybox + securityContext: + runAsNonRoot: false + + - it: applies the default security context to additional containers unless overridden + set: + deployment.additionalContainers: + plain: + image: busybox + custom: + image: busybox + securityContext: + runAsNonRoot: false + asserts: + - contains: + path: spec.template.spec.containers + content: + name: plain + image: busybox + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - contains: + path: spec.template.spec.containers + content: + name: custom + image: busybox + securityContext: + runAsNonRoot: false + - it: applies the runtime default seccomp profile at pod level by default asserts: - equal: diff --git a/application/tests/job_test.yaml b/application/tests/job_test.yaml index 1593408e..862bad81 100644 --- a/application/tests/job_test.yaml +++ b/application/tests/job_test.yaml @@ -213,11 +213,13 @@ tests: content: name: example1 image: another-example-registry/another-example-image:another-example-tag + any: true - contains: path: spec.template.spec.initContainers content: name: example2 image: another-example-registry/another-example-image:another-example-tag + any: true - notContains: path: spec.template.spec.initContainers content: @@ -394,7 +396,7 @@ tests: path: spec.template.spec.serviceAccountName value: example-app - - it: does not include container security context by default + - it: applies the default security context to init containers unless overridden set: job: enabled: true @@ -403,9 +405,53 @@ tests: image: repository: example-registry/example-image tag: example-tag + initContainers: + plain: + image: busybox + custom: + image: busybox + securityContext: + runAsNonRoot: false asserts: - - notExists: + - contains: + path: spec.template.spec.initContainers + content: + name: plain + image: busybox + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - contains: + path: spec.template.spec.initContainers + content: + name: custom + image: busybox + securityContext: + runAsNonRoot: false + + - it: applies a restricted container security context by default + set: + job: + enabled: true + jobs: + example: + image: + repository: example-registry/example-image + tag: example-tag + asserts: + - equal: path: spec.template.spec.containers[0].securityContext + value: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL - it: enable container security context when configured set: @@ -461,7 +507,7 @@ tests: path: spec.template.spec.automountServiceAccountToken value: true - - it: does not include pod security context by default + - it: applies the runtime default seccomp profile at pod level by default set: job: enabled: true @@ -471,8 +517,11 @@ tests: repository: example-registry/example-image tag: example-tag asserts: - - notExists: + - equal: path: spec.template.spec.securityContext + value: + seccompProfile: + type: RuntimeDefault - it: enable pod security context when configured set: diff --git a/application/values.schema.json b/application/values.schema.json index 1105fb40..1fc102f2 100644 --- a/application/values.schema.json +++ b/application/values.schema.json @@ -740,6 +740,51 @@ "cronJob": { "description": " example.com/team: team-name example.com/owner: owner-name", "properties": { + "containerSecurityContext": { + "description": "Default Security Context at container level for all CronJobs. Can be overridden per job with `containerSecurityContext`.", + "properties": { + "allowPrivilegeEscalation": { + "default": false, + "title": "allowPrivilegeEscalation", + "type": "boolean" + }, + "capabilities": { + "properties": { + "drop": { + "items": { + "anyOf": [ + { + "type": "string" + } + ], + "required": [] + }, + "title": "drop", + "type": "array" + } + }, + "required": [], + "title": "capabilities", + "type": "object" + }, + "readOnlyRootFilesystem": { + "default": true, + "title": "readOnlyRootFilesystem", + "type": "boolean" + }, + "runAsNonRoot": { + "default": true, + "title": "runAsNonRoot", + "type": "boolean" + } + }, + "required": [], + "title": "containerSecurityContext", + "type": [ + "object", + "null" + ] + }, "enabled": { "default": false, "description": "Deploy CronJob resources.", @@ -755,6 +800,29 @@ "object", "null" ] + }, + "securityContext": { + "description": "Default Security Context at pod level for all CronJobs. Can be overridden per job with `securityContext`.", + "properties": { + "seccompProfile": { + "properties": { + "type": { + "default": "RuntimeDefault", + "title": "type", + "type": "string" + } + }, + "required": [], + "title": "seccompProfile", + "type": "object" + } + }, + "required": [], + "title": "securityContext", + "type": [ + "object", + "null" + ] } }, "required": [], @@ -1977,6 +2045,51 @@ }, "job": { "properties": { + "containerSecurityContext": { + "description": "Default Security Context at container level for all Jobs. Can be overridden per job with `containerSecurityContext`.", + "properties": { + "allowPrivilegeEscalation": { + "default": false, + "title": "allowPrivilegeEscalation", + "type": "boolean" + }, + "capabilities": { + "properties": { + "drop": { + "items": { + "anyOf": [ + { + "type": "string" + } + ], + "required": [] + }, + "title": "drop", + "type": "array" + } + }, + "required": [], + "title": "capabilities", + "type": "object" + }, + "readOnlyRootFilesystem": { + "default": true, + "title": "readOnlyRootFilesystem", + "type": "boolean" + }, + "runAsNonRoot": { + "default": true, + "title": "runAsNonRoot", + "type": "boolean" + } + }, + "required": [], + "title": "containerSecurityContext", + "type": [ + "object", + "null" + ] + }, "enabled": { "default": false, "description": "Deploy Job resources.", @@ -1992,6 +2105,29 @@ "object", "null" ] + }, + "securityContext": { + "description": "Default Security Context at pod level for all Jobs. Can be overridden per job with `securityContext`.", + "properties": { + "seccompProfile": { + "properties": { + "type": { + "default": "RuntimeDefault", + "title": "type", + "type": "string" + } + }, + "required": [], + "title": "seccompProfile", + "type": "object" + } + }, + "required": [], + "title": "securityContext", + "type": [ + "object", + "null" + ] } }, "required": [], diff --git a/application/values.yaml b/application/values.yaml index 7ac9a60b..d77f16a2 100644 --- a/application/values.yaml +++ b/application/values.yaml @@ -31,6 +31,20 @@ cronJob: # -- (bool) Deploy CronJob resources. # @section -- CronJob Parameters enabled: false + # -- (object, null) Default Security Context at pod level for all CronJobs. Can be overridden per job with `securityContext`. + # @section -- CronJob Parameters + securityContext: + seccompProfile: + type: RuntimeDefault + # -- (object, null) Default Security Context at container level for all CronJobs. Can be overridden per job with `containerSecurityContext`. + # @section -- CronJob Parameters + containerSecurityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL # -- (object, null) Map of CronJob resources. # Key will be used as a name suffix for the CronJob. Value is the CronJob configuration. # See values for more details. @@ -95,6 +109,20 @@ job: # -- (bool) Deploy Job resources. # @section -- Job Parameters enabled: false + # -- (object, null) Default Security Context at pod level for all Jobs. Can be overridden per job with `securityContext`. + # @section -- Job Parameters + securityContext: + seccompProfile: + type: RuntimeDefault + # -- (object, null) Default Security Context at container level for all Jobs. Can be overridden per job with `containerSecurityContext`. + # @section -- Job Parameters + containerSecurityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL # -- (object, null) Map of Job resources. # Key will be used as a name suffix for the Job. Value is the Job configuration. # See values for more details.