From f62d6b717fed317e7c2ef535f9bd2e05b33797a3 Mon Sep 17 00:00:00 2001 From: Zadkiel AHARONIAN Date: Wed, 19 Aug 2026 16:36:06 +0200 Subject: [PATCH 1/3] feat(deployment)!: drop all capabilities in default security context Signed-off-by: Zadkiel AHARONIAN --- README.md | 2 +- application/tests/deployment_test.yaml | 12 ++++++++++++ application/values.schema.json | 24 ++++++++++++++++++++++++ application/values.yaml | 4 ++++ 4 files changed, 41 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 3ff8e3c0..db20e995 100644 --- a/README.md +++ b/README.md @@ -142,7 +142,7 @@ Please refer to the [Contributing Guide](CONTRIBUTING.md) for details on how to | deployment.livenessProbe.tcpSocket | object | `{}` | TCP Socket probe. | | deployment.livenessProbe.grpc | object | `{}` | gRPC probe. | | deployment.resources | object | `{}` | Resource limits and requests for the pod. | -| deployment.containerSecurityContext | object, null | `{"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Security Context at Container Level. | +| deployment.containerSecurityContext | object, null | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Security Context at Container Level. | | deployment.openshiftOAuthProxy.enabled | bool | `false` | Enable [OpenShift OAuth Proxy](https://github.com/openshift/oauth-proxy). | | deployment.openshiftOAuthProxy.port | int | `8080` | Port on which application is running inside container. | | deployment.openshiftOAuthProxy.secretName | string | `"openshift-oauth-proxy-tls"` | Secret name for the OAuth Proxy TLS certificate. | diff --git a/application/tests/deployment_test.yaml b/application/tests/deployment_test.yaml index 7b42113e..97a50387 100644 --- a/application/tests/deployment_test.yaml +++ b/application/tests/deployment_test.yaml @@ -8,6 +8,18 @@ set: deployment.image.tag: example-tag tests: + - it: applies a restricted container security context by default + asserts: + - equal: + path: spec.template.spec.containers[0].securityContext + value: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - it: does not include OAuth proxy container if disabled set: deployment.openshiftOAuthProxy.enabled: false diff --git a/application/values.schema.json b/application/values.schema.json index 65c6f572..98989298 100644 --- a/application/values.schema.json +++ b/application/values.schema.json @@ -838,6 +838,30 @@ "containerSecurityContext": { "description": "Security Context at Container Level.", "properties": { + "allowPrivilegeEscalation": { + "default": false, + "title": "allowPrivilegeEscalation", + "type": "boolean" + }, + "capabilities": { + "properties": { + "drop": { + "items": { + "anyOf": [ + { + "type": "string" + } + ], + "required": [] + }, + "title": "drop", + "type": "array" + } + }, + "required": [], + "title": "capabilities", + "type": "object" + }, "readOnlyRootFilesystem": { "default": true, "title": "readOnlyRootFilesystem", diff --git a/application/values.yaml b/application/values.yaml index e5543099..8ab01e48 100644 --- a/application/values.yaml +++ b/application/values.yaml @@ -463,6 +463,10 @@ deployment: containerSecurityContext: readOnlyRootFilesystem: true runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL openshiftOAuthProxy: # -- (bool) Enable [OpenShift OAuth Proxy](https://github.com/openshift/oauth-proxy). # @section -- Deployment Parameters From 27b234d9aaff74659318f3bb62d0c00db2a2f51a Mon Sep 17 00:00:00 2001 From: Zadkiel AHARONIAN Date: Wed, 19 Aug 2026 16:42:22 +0200 Subject: [PATCH 2/3] feat(deployment)!: add seccomp default and oauth proxy security context Signed-off-by: Zadkiel AHARONIAN --- README.md | 3 +- application/templates/deployment.yaml | 4 ++ .../tests/__snapshot__/common_test.yaml.snap | 7 +++ application/tests/deployment_test.yaml | 25 ++++++++ application/values.schema.json | 60 ++++++++++++++++++- application/values.yaml | 11 ++++ 6 files changed, 108 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index db20e995..bfb56740 100644 --- a/README.md +++ b/README.md @@ -145,10 +145,11 @@ Please refer to the [Contributing Guide](CONTRIBUTING.md) for details on how to | deployment.containerSecurityContext | object, null | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Security Context at Container Level. | | deployment.openshiftOAuthProxy.enabled | bool | `false` | Enable [OpenShift OAuth Proxy](https://github.com/openshift/oauth-proxy). | | deployment.openshiftOAuthProxy.port | int | `8080` | Port on which application is running inside container. | +| deployment.openshiftOAuthProxy.containerSecurityContext | object, null | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Security Context for the OAuth Proxy container. | | deployment.openshiftOAuthProxy.secretName | string | `"openshift-oauth-proxy-tls"` | Secret name for the OAuth Proxy TLS certificate. | | deployment.openshiftOAuthProxy.image | string | `quay.io/openshift/origin-oauth-proxy:latest` pinned by digest | Image for the OAuth Proxy. | | deployment.openshiftOAuthProxy.disableTLSArg | bool | `false` | If disabled `--http-address=:8081` will be used instead of `--https-address=:8443`. It can be useful when an ingress is enabled for the application. | -| deployment.securityContext | object, null | `nil` | Security Context for the pod. | +| deployment.securityContext | object, null | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Security Context for the pod. | | deployment.command | list | `[]` | Command for the app container. | | deployment.args | list | `[]` | Args for the app container. | | deployment.automountServiceAccountToken | bool | `false` | Mount Service Account token. | diff --git a/application/templates/deployment.yaml b/application/templates/deployment.yaml index c7cfe2c8..6b336d01 100644 --- a/application/templates/deployment.yaml +++ b/application/templates/deployment.yaml @@ -138,6 +138,10 @@ spec: - containerPort: 8443 {{- end }} name: proxy + {{- with .Values.deployment.openshiftOAuthProxy.containerSecurityContext }} + securityContext: + {{- toYaml . | nindent 10 }} + {{- end }} volumeMounts: - mountPath: /etc/tls/private name: proxy-tls diff --git a/application/tests/__snapshot__/common_test.yaml.snap b/application/tests/__snapshot__/common_test.yaml.snap index 8762d570..0197f0b6 100644 --- a/application/tests/__snapshot__/common_test.yaml.snap +++ b/application/tests/__snapshot__/common_test.yaml.snap @@ -399,6 +399,13 @@ should match snapshot: ports: - containerPort: 8443 name: proxy + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true volumeMounts: - mountPath: /etc/tls/private name: proxy-tls diff --git a/application/tests/deployment_test.yaml b/application/tests/deployment_test.yaml index 97a50387..6993a991 100644 --- a/application/tests/deployment_test.yaml +++ b/application/tests/deployment_test.yaml @@ -20,6 +20,31 @@ tests: drop: - ALL + - it: applies the runtime default seccomp profile at pod level by default + asserts: + - equal: + path: spec.template.spec.securityContext + value: + seccompProfile: + type: RuntimeDefault + + - it: applies a restricted security context to the OAuth proxy container + set: + deployment.openshiftOAuthProxy.enabled: true + asserts: + - equal: + path: spec.template.spec.containers[0].name + value: oauth-proxy + - equal: + path: spec.template.spec.containers[0].securityContext + value: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - it: does not include OAuth proxy container if disabled set: deployment.openshiftOAuthProxy.enabled: false diff --git a/application/values.schema.json b/application/values.schema.json index 98989298..2c4717f6 100644 --- a/application/values.schema.json +++ b/application/values.schema.json @@ -1105,6 +1105,51 @@ }, "openshiftOAuthProxy": { "properties": { + "containerSecurityContext": { + "description": "Security Context for the OAuth Proxy container.", + "properties": { + "allowPrivilegeEscalation": { + "default": false, + "title": "allowPrivilegeEscalation", + "type": "boolean" + }, + "capabilities": { + "properties": { + "drop": { + "items": { + "anyOf": [ + { + "type": "string" + } + ], + "required": [] + }, + "title": "drop", + "type": "array" + } + }, + "required": [], + "title": "capabilities", + "type": "object" + }, + "readOnlyRootFilesystem": { + "default": true, + "title": "readOnlyRootFilesystem", + "type": "boolean" + }, + "runAsNonRoot": { + "default": true, + "title": "runAsNonRoot", + "type": "boolean" + } + }, + "required": [], + "title": "containerSecurityContext", + "type": [ + "object", + "null" + ] + }, "disableTLSArg": { "default": false, "description": "If disabled `--http-address=:8081` will be used instead of `--https-address=:8443`. It can be useful when an ingress is enabled for the application.", @@ -1275,8 +1320,21 @@ ] }, "securityContext": { - "default": "", "description": "Security Context for the pod.", + "properties": { + "seccompProfile": { + "properties": { + "type": { + "default": "RuntimeDefault", + "title": "type", + "type": "string" + } + }, + "required": [], + "title": "seccompProfile", + "type": "object" + } + }, "required": [], "title": "securityContext", "type": [ diff --git a/application/values.yaml b/application/values.yaml index 8ab01e48..7103d5c3 100644 --- a/application/values.yaml +++ b/application/values.yaml @@ -474,6 +474,15 @@ deployment: # -- (int) Port on which application is running inside container. # @section -- Deployment Parameters port: 8080 + # -- (object, null) Security Context for the OAuth Proxy container. + # @section -- Deployment Parameters + containerSecurityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL # -- (string) Secret name for the OAuth Proxy TLS certificate. # @section -- Deployment Parameters secretName: "openshift-oauth-proxy-tls" @@ -488,6 +497,8 @@ deployment: # -- (object, null) Security Context for the pod. # @section -- Deployment Parameters securityContext: + seccompProfile: + type: RuntimeDefault # fsGroup: 2000 # -- (list) Command for the app container. # @section -- Deployment Parameters From 3470623834ed6ea72a2f54ba0de6187943485fde Mon Sep 17 00:00:00 2001 From: Zadkiel AHARONIAN Date: Wed, 19 Aug 2026 16:48:50 +0200 Subject: [PATCH 3/3] feat(security)!: extend restricted defaults to jobs and all containers Signed-off-by: Zadkiel AHARONIAN --- README.md | 4 + application/templates/cronjob.yaml | 10 +- application/templates/deployment.yaml | 16 ++- application/templates/job.yaml | 10 +- application/tests/cronjob_test.yaml | 57 ++++++++++- application/tests/deployment_test.yaml | 60 +++++++++++ application/tests/job_test.yaml | 57 ++++++++++- application/values.schema.json | 136 +++++++++++++++++++++++++ application/values.yaml | 28 +++++ 9 files changed, 365 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index bfb56740..cd3fd80d 100644 --- a/README.md +++ b/README.md @@ -68,6 +68,8 @@ Please refer to the [Contributing Guide](CONTRIBUTING.md) for details on how to | Key | Type | Default | Description | |-----|------|---------|-------------| | cronJob.enabled | bool | `false` | Deploy CronJob resources. | +| cronJob.securityContext | object, null | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Default Security Context at pod level for all CronJobs. Can be overridden per job with `securityContext`. | +| cronJob.containerSecurityContext | object, null | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Default Security Context at container level for all CronJobs. Can be overridden per job with `containerSecurityContext`. | | cronJob.jobs | object, null | `nil` | Map of CronJob resources. Key will be used as a name suffix for the CronJob. Value is the CronJob configuration. See values for more details. | ### Job Parameters @@ -75,6 +77,8 @@ Please refer to the [Contributing Guide](CONTRIBUTING.md) for details on how to | Key | Type | Default | Description | |-----|------|---------|-------------| | job.enabled | bool | `false` | Deploy Job resources. | +| job.securityContext | object, null | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Default Security Context at pod level for all Jobs. Can be overridden per job with `securityContext`. | +| job.containerSecurityContext | object, null | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Default Security Context at container level for all Jobs. Can be overridden per job with `containerSecurityContext`. | | job.jobs | object, null | `nil` | Map of Job resources. Key will be used as a name suffix for the Job. Value is the Job configuration. See values for more details. | ### Deployment Parameters diff --git a/application/templates/cronjob.yaml b/application/templates/cronjob.yaml index 0e82c095..5c18a873 100644 --- a/application/templates/cronjob.yaml +++ b/application/templates/cronjob.yaml @@ -69,6 +69,12 @@ spec: {{- range $key, $value := . }} - name: {{ $key }} {{- dict "value" (omit $value "name") "context" $ | include "application.tplvalues.render" | nindent 12 }} + {{- if not (hasKey $value "securityContext") }} + {{- with $job.containerSecurityContext | default $.Values.cronJob.containerSecurityContext }} + securityContext: + {{- toYaml . | nindent 14 }} + {{- end }} + {{- end }} {{- end }} {{- end }} containers: @@ -135,7 +141,7 @@ spec: volumeMounts: {{ toYaml . | indent 12 }} {{- end }} - {{- with $job.containerSecurityContext }} + {{- with $job.containerSecurityContext | default $.Values.cronJob.containerSecurityContext }} securityContext: {{- toYaml . | nindent 14 }} {{- end }} @@ -165,7 +171,7 @@ spec: imagePullSecrets: {{- toYaml . | nindent 12 }} {{- end }} - {{- with $job.securityContext }} + {{- with $job.securityContext | default $.Values.cronJob.securityContext }} securityContext: {{- toYaml . | nindent 12 }} {{- end }} diff --git a/application/templates/deployment.yaml b/application/templates/deployment.yaml index 6b336d01..30d4225d 100644 --- a/application/templates/deployment.yaml +++ b/application/templates/deployment.yaml @@ -86,6 +86,12 @@ spec: {{- range $key, $value := .Values.deployment.initContainers }} - name: {{ $key }} {{ include "application.tplvalues.render" ( dict "value" $value "context" $ ) | indent 8 }} + {{- if not (hasKey $value "securityContext") }} + {{- with $.Values.deployment.containerSecurityContext }} + securityContext: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- end }} {{- end }} {{- end }} {{- if .Values.deployment.nodeSelector }} @@ -301,10 +307,18 @@ spec: {{- $containers := . }} {{- range $name := keys . | sortAlpha }} {{- $container := index $containers $name }} + {{- if and (not (hasKey $container "securityContext")) $.Values.deployment.containerSecurityContext }} + {{- $container = merge (dict "securityContext" $.Values.deployment.containerSecurityContext) $container }} + {{- end }} - {{- merge (dict "name" $name) $container | toYaml | nindent 8 }} {{- end }} {{- else }} -{{ toYaml . | indent 6 }} + {{- range $container := . }} + {{- if and (not (hasKey $container "securityContext")) $.Values.deployment.containerSecurityContext }} + {{- $container = merge (dict "securityContext" $.Values.deployment.containerSecurityContext) $container }} + {{- end }} + - {{- $container | toYaml | nindent 8 }} + {{- end }} {{- end }} {{- end }} {{- if .Values.deployment.securityContext }} diff --git a/application/templates/job.yaml b/application/templates/job.yaml index 361546e4..aacb22e3 100644 --- a/application/templates/job.yaml +++ b/application/templates/job.yaml @@ -49,6 +49,12 @@ spec: {{- range $key, $value := . }} - name: {{ $key }} {{- dict "value" (omit $value "name") "context" $ | include "application.tplvalues.render" | nindent 8 }} + {{- if not (hasKey $value "securityContext") }} + {{- with $job.containerSecurityContext | default $.Values.job.containerSecurityContext }} + securityContext: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- end }} {{- end }} {{- end }} containers: @@ -111,7 +117,7 @@ spec: resources: {{ toYaml . | indent 10 }} {{- end }} - {{- with $job.containerSecurityContext }} + {{- with $job.containerSecurityContext | default $.Values.job.containerSecurityContext }} securityContext: {{- toYaml . | nindent 10 }} {{- end }} @@ -133,7 +139,7 @@ spec: {{- with $job.topologySpreadConstraints }} topologySpreadConstraints: {{ toYaml . | nindent 8 }} {{- end }} - {{- with $job.securityContext }} + {{- with $job.securityContext | default $.Values.job.securityContext }} securityContext: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/application/tests/cronjob_test.yaml b/application/tests/cronjob_test.yaml index 58e644c2..629482c1 100644 --- a/application/tests/cronjob_test.yaml +++ b/application/tests/cronjob_test.yaml @@ -213,11 +213,13 @@ tests: content: name: example1 image: another-example-registry/another-example-image:another-example-tag + any: true - contains: path: spec.jobTemplate.spec.template.spec.initContainers content: name: example2 image: another-example-registry/another-example-image:another-example-tag + any: true - notContains: path: spec.jobTemplate.spec.template.spec.initContainers content: @@ -398,7 +400,7 @@ tests: path: spec.jobTemplate.spec.template.spec.serviceAccountName value: example-app - - it: does not include container security context by default + - it: applies the default security context to init containers unless overridden set: cronJob: enabled: true @@ -407,9 +409,53 @@ tests: image: repository: example-registry/example-image tag: example-tag + initContainers: + plain: + image: busybox + custom: + image: busybox + securityContext: + runAsNonRoot: false asserts: - - notExists: + - contains: + path: spec.jobTemplate.spec.template.spec.initContainers + content: + name: plain + image: busybox + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - contains: + path: spec.jobTemplate.spec.template.spec.initContainers + content: + name: custom + image: busybox + securityContext: + runAsNonRoot: false + + - it: applies a restricted container security context by default + set: + cronJob: + enabled: true + jobs: + example: + image: + repository: example-registry/example-image + tag: example-tag + asserts: + - equal: path: spec.jobTemplate.spec.template.spec.containers[0].securityContext + value: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL - it: enable container security context when configured set: @@ -465,7 +511,7 @@ tests: path: spec.jobTemplate.spec.template.spec.automountServiceAccountToken value: true - - it: does not include pod security context by default + - it: applies the runtime default seccomp profile at pod level by default set: cronJob: enabled: true @@ -475,8 +521,11 @@ tests: repository: example-registry/example-image tag: example-tag asserts: - - notExists: + - equal: path: spec.jobTemplate.spec.template.spec.securityContext + value: + seccompProfile: + type: RuntimeDefault - it: enable pod security context when configured set: diff --git a/application/tests/deployment_test.yaml b/application/tests/deployment_test.yaml index 6993a991..5e083969 100644 --- a/application/tests/deployment_test.yaml +++ b/application/tests/deployment_test.yaml @@ -20,6 +20,66 @@ tests: drop: - ALL + - it: applies the default security context to init containers unless overridden + set: + deployment.initContainers: + plain: + image: busybox + custom: + image: busybox + securityContext: + runAsNonRoot: false + asserts: + - contains: + path: spec.template.spec.initContainers + content: + name: plain + image: busybox + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - contains: + path: spec.template.spec.initContainers + content: + name: custom + image: busybox + securityContext: + runAsNonRoot: false + + - it: applies the default security context to additional containers unless overridden + set: + deployment.additionalContainers: + plain: + image: busybox + custom: + image: busybox + securityContext: + runAsNonRoot: false + asserts: + - contains: + path: spec.template.spec.containers + content: + name: plain + image: busybox + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - contains: + path: spec.template.spec.containers + content: + name: custom + image: busybox + securityContext: + runAsNonRoot: false + - it: applies the runtime default seccomp profile at pod level by default asserts: - equal: diff --git a/application/tests/job_test.yaml b/application/tests/job_test.yaml index 1593408e..862bad81 100644 --- a/application/tests/job_test.yaml +++ b/application/tests/job_test.yaml @@ -213,11 +213,13 @@ tests: content: name: example1 image: another-example-registry/another-example-image:another-example-tag + any: true - contains: path: spec.template.spec.initContainers content: name: example2 image: another-example-registry/another-example-image:another-example-tag + any: true - notContains: path: spec.template.spec.initContainers content: @@ -394,7 +396,7 @@ tests: path: spec.template.spec.serviceAccountName value: example-app - - it: does not include container security context by default + - it: applies the default security context to init containers unless overridden set: job: enabled: true @@ -403,9 +405,53 @@ tests: image: repository: example-registry/example-image tag: example-tag + initContainers: + plain: + image: busybox + custom: + image: busybox + securityContext: + runAsNonRoot: false asserts: - - notExists: + - contains: + path: spec.template.spec.initContainers + content: + name: plain + image: busybox + securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - contains: + path: spec.template.spec.initContainers + content: + name: custom + image: busybox + securityContext: + runAsNonRoot: false + + - it: applies a restricted container security context by default + set: + job: + enabled: true + jobs: + example: + image: + repository: example-registry/example-image + tag: example-tag + asserts: + - equal: path: spec.template.spec.containers[0].securityContext + value: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL - it: enable container security context when configured set: @@ -461,7 +507,7 @@ tests: path: spec.template.spec.automountServiceAccountToken value: true - - it: does not include pod security context by default + - it: applies the runtime default seccomp profile at pod level by default set: job: enabled: true @@ -471,8 +517,11 @@ tests: repository: example-registry/example-image tag: example-tag asserts: - - notExists: + - equal: path: spec.template.spec.securityContext + value: + seccompProfile: + type: RuntimeDefault - it: enable pod security context when configured set: diff --git a/application/values.schema.json b/application/values.schema.json index 2c4717f6..aa89aa49 100644 --- a/application/values.schema.json +++ b/application/values.schema.json @@ -740,6 +740,51 @@ "cronJob": { "description": " example.com/team: team-name example.com/owner: owner-name", "properties": { + "containerSecurityContext": { + "description": "Default Security Context at container level for all CronJobs. Can be overridden per job with `containerSecurityContext`.", + "properties": { + "allowPrivilegeEscalation": { + "default": false, + "title": "allowPrivilegeEscalation", + "type": "boolean" + }, + "capabilities": { + "properties": { + "drop": { + "items": { + "anyOf": [ + { + "type": "string" + } + ], + "required": [] + }, + "title": "drop", + "type": "array" + } + }, + "required": [], + "title": "capabilities", + "type": "object" + }, + "readOnlyRootFilesystem": { + "default": true, + "title": "readOnlyRootFilesystem", + "type": "boolean" + }, + "runAsNonRoot": { + "default": true, + "title": "runAsNonRoot", + "type": "boolean" + } + }, + "required": [], + "title": "containerSecurityContext", + "type": [ + "object", + "null" + ] + }, "enabled": { "default": false, "description": "Deploy CronJob resources.", @@ -755,6 +800,29 @@ "object", "null" ] + }, + "securityContext": { + "description": "Default Security Context at pod level for all CronJobs. Can be overridden per job with `securityContext`.", + "properties": { + "seccompProfile": { + "properties": { + "type": { + "default": "RuntimeDefault", + "title": "type", + "type": "string" + } + }, + "required": [], + "title": "seccompProfile", + "type": "object" + } + }, + "required": [], + "title": "securityContext", + "type": [ + "object", + "null" + ] } }, "required": [], @@ -1977,6 +2045,51 @@ }, "job": { "properties": { + "containerSecurityContext": { + "description": "Default Security Context at container level for all Jobs. Can be overridden per job with `containerSecurityContext`.", + "properties": { + "allowPrivilegeEscalation": { + "default": false, + "title": "allowPrivilegeEscalation", + "type": "boolean" + }, + "capabilities": { + "properties": { + "drop": { + "items": { + "anyOf": [ + { + "type": "string" + } + ], + "required": [] + }, + "title": "drop", + "type": "array" + } + }, + "required": [], + "title": "capabilities", + "type": "object" + }, + "readOnlyRootFilesystem": { + "default": true, + "title": "readOnlyRootFilesystem", + "type": "boolean" + }, + "runAsNonRoot": { + "default": true, + "title": "runAsNonRoot", + "type": "boolean" + } + }, + "required": [], + "title": "containerSecurityContext", + "type": [ + "object", + "null" + ] + }, "enabled": { "default": false, "description": "Deploy Job resources.", @@ -1992,6 +2105,29 @@ "object", "null" ] + }, + "securityContext": { + "description": "Default Security Context at pod level for all Jobs. Can be overridden per job with `securityContext`.", + "properties": { + "seccompProfile": { + "properties": { + "type": { + "default": "RuntimeDefault", + "title": "type", + "type": "string" + } + }, + "required": [], + "title": "seccompProfile", + "type": "object" + } + }, + "required": [], + "title": "securityContext", + "type": [ + "object", + "null" + ] } }, "required": [], diff --git a/application/values.yaml b/application/values.yaml index 7103d5c3..f8c9c8cf 100644 --- a/application/values.yaml +++ b/application/values.yaml @@ -31,6 +31,20 @@ cronJob: # -- (bool) Deploy CronJob resources. # @section -- CronJob Parameters enabled: false + # -- (object, null) Default Security Context at pod level for all CronJobs. Can be overridden per job with `securityContext`. + # @section -- CronJob Parameters + securityContext: + seccompProfile: + type: RuntimeDefault + # -- (object, null) Default Security Context at container level for all CronJobs. Can be overridden per job with `containerSecurityContext`. + # @section -- CronJob Parameters + containerSecurityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL # -- (object, null) Map of CronJob resources. # Key will be used as a name suffix for the CronJob. Value is the CronJob configuration. # See values for more details. @@ -95,6 +109,20 @@ job: # -- (bool) Deploy Job resources. # @section -- Job Parameters enabled: false + # -- (object, null) Default Security Context at pod level for all Jobs. Can be overridden per job with `securityContext`. + # @section -- Job Parameters + securityContext: + seccompProfile: + type: RuntimeDefault + # -- (object, null) Default Security Context at container level for all Jobs. Can be overridden per job with `containerSecurityContext`. + # @section -- Job Parameters + containerSecurityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL # -- (object, null) Map of Job resources. # Key will be used as a name suffix for the Job. Value is the Job configuration. # See values for more details.