add podSecurityContext and containerSecurityContext

fkie-cad · Nov 22, 2024 · c0b8de1 · c0b8de1
1 parent 56cf412
commit c0b8de1
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 8 deletions.
diff --git a/charts/logprep/templates/deployment.yaml b/charts/logprep/templates/deployment.yaml
@@ -20,17 +20,18 @@ spec:
       annotations:
         {{ toYaml .Values.podAnnotations| nindent 8 }}
     spec:
+      {{ - if .Values.podSecurityContext.enabled }}
       securityContext:
-        fsGroup: {{ .Values.securityContext.runAsUser }}
-        runAsUser: {{ .Values.securityContext.runAsUser }}
+      {{- omit  .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
       imagePullSecrets:
         {{- if .Values.secrets.imagePullSecret }}
         - name: {{ .Values.secrets.imagePullSecret.name }}
         {{- end }}
       containers:
         - name: logprep
+            {{- if .Values.conatinerSecurityContext.enabled }}
           securityContext:
-            {{- toYaml .Values.securityContext | nindent 12 }}
+            {{- omit  .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
           image: {{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}

diff --git a/charts/logprep/values.yaml b/charts/logprep/values.yaml
@@ -18,15 +18,21 @@ resources:
     memory: "2Gi"
     cpu: "250m"
 
-# The default security context for the pod
-securityContext:
-  capabilities:
-    drop:
-      - ALL
+# if enabled: the default security context for the pod
+podSecurityContext:
+  enabled: true
+  fsgroup: 1000
   runAsNonRoot: true
   runAsUser: 1000
   readOnlyRootFilesystem: true
 
+# if enabled: the default security context for the container 
+containerSecruityContext:
+  enabled: true
+  capabilities:
+      drop:
+        - ALL
+
 # the image pull secret to use for the deployment
 # to mount extra secrets into the pod, use the extraVolumes and extraMounts fields
 # secrets: