Skip to content

Allow to specify securityContext for vaultConfigurer container #231

@msg-gregor

Description

@msg-gregor

Preflight Checklist

  • I have searched the issue tracker for an issue that matches the one I want to file, without success.
  • I agree to follow the Code of Conduct.

Problem Description

Vault operator does not allow to specify securityContext for the vaultConfigurer pod container, it only allows to specify the podSecurityContext for the whole pod

This is not sufficient in all cases. For example, we deploy in a managed rancher kubernetes cluster with strict security policies. All containers are forced to have the following security profile or they won't be scheduled:

securityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ "ALL" ]
  seccompProfile:
    type: RuntimeDefault

Some but not all of them can be set by using the pods security context on a pod level, however, e.g., allowPrivilegeEscalation and capabilities can only be set on a container level

This missing feature prevents us from using bank-vaults operator, because it is impossible for us to deploy the vaultConfigurer pod

Proposed Solution

Add a vaultConfigurerContainerSpec that allows to configure/extend container spec for vaultConfigurer - similar to the already existing vaultContainerSpec - to the VaultSpec API

Alternatives Considered

No response

Additional Information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/enhancementCategorizes issue or PR as related to an improvement.lifecycle/keepDenotes an issue or PR that should be preserved from going stale.triage/acceptedIndicates an issue or PR is ready to be actively worked on.

    Type

    No type

    Projects

    Status

    📋 Backlog

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions